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Mr. «So this is an interview of Jennifer Moore conducted by the House 
Select Committee to Investigate the January 6th Attack on the United States Capitol 
pursuant to House resolution 503. 

Ms. Moore, could you please state your full name and spell your name -- last 
name for the record. 

Ms. Moore. Jennifer Lee Moore, last name spelled M-o-o-r-e. 


Vr. I'll start by asking everyone in the room to introduce themselves 


for the record. I'll begin with my colleagues. 
Mr. lm PF I'm the chief investigative counsel. Thanks for 
being here. 


Ve | Hi. HE, senior investigative counsel. Thank 


you, all. 

Mr. bee =a professional staff. 

Vv. I'd ask that your counsel now introduce themselves. 

Ms. Greer. Hi. Megan Greer from FBI Office of General Counsel. 

Ms. Toth. I'm Katherine Toth, also from FBI Office of General Counsel. 

Ms. Antell. Kira Antell, Office of Legislative Affairs, U.S. DOJ. 

Mr. Espiritu. Mark Espiritu, FBI Office of Congressional Affairs. 

Mr. = This will be a staff-led interview, and members, of course, may 
choose to ask questions if they happen to join the call. My name is po and 
I'm an investigative counsel for the select committee. 

Before we begin, I'd like to describe a few ground rules. This is an official 
reporter transcribed -- there is an official reporter transcribing the record of this 
interview. Please wait until each question is completed before you begin your response, 


and we will try to wait until your response is complete before we ask our next question. 
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The stenographer cannot record nonverbal responses, such as shaking your head, 
so it is important that you answer each question with an audible, verbal response. We 
ask that you provide complete answers based on your best recollection. If the question 
is not clear, please ask for clarification. If you do not know the answer, please simply 
Say SO. 

| also want to remind you that it is unlawful to deliberately provide false 
information to Congress, which we, of course, advise every witness that appears before 
us. And you will have an opportunity to review the transcript once it is completed. 

It's my understanding you have a statement you'd like to read into the record? 

Ms. Moore. Ido. 

Ms. Greer. If | -- if | could make just one comment. Thank you for having us. 
EAD Moore has been authorized by the Department to talk about the Washington Field 
Office's preparations in advance of January 6th. Of course, she needs to be mindful to 
not speak about ongoing investigations and prosecutions. 

Just as a global matter, a number of the pieces of information she'll be discussing 
today is law enforcement sensitive at the "for official use only" level, and as always, we 
appreciate the committee's ongoing cooperation with us in making sure that that 
information is protected. 

Ms. Moore. All right. 

via And before we start, we need to start recording on the video itself, so 
| just want to make everyone aware. And | need to figure that out myself because 
Sadallah is saying that | need to do it on my end here. 

Ms. Antell. There's no video recording. 

Ms. So the Webex records automatically, so | think that's what 


ei: talking about. By our terms, we understand there's no video recording. 
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Mr. So we're off the record. 

Via Off the record. Thank you. 

[Discussion off the record. ] 

VW. ae We can go back on the record, and the floor is yours, Ms. Moore. 

Ms. Moore. Good morning. My name is Jennifer Moore, and I'm an executive 
assistant director at the FBI. | have served in a number of roles since | joined the Bureau 
27 years ago, including as special agent following my selection in 1998. In 2019, | was 
named special agent in charge of the intelligence division at the Washington Field Office. 
This is the position | held on January 6, 2021. | returned to FBI quarters in July of last 
year, and | am now the executive assistant director of the human resources branch. 

| am here today to address WFO's preparations and planning for January 6th. As 
you know, this supplements the FBI's numerous document productions and briefings that 
have been provided to the committee. 

Before | take your questions, | want to briefly provide an overview of the steps 
that Washington Field Office undertook in the days leading up to January 6th to detect 
and prevent threats of violence. Our efforts fell into three main categories: First, we 
sought and collected intelligence that we legally could, including information that was 
posted online or collected from other FBI field offices throughout the country; second, we 
continuously shared intelligence with our partners in the national capital region through 
multiple avenues, including frequent phone calls, scheduled meetings, emails and the 
establishment of command posts, both at the Washington Field Office and FBI 
headquarters; third, based on what we were seeing in intelligence, we took the rather 
extraordinary step of prepositioning or placing on standby tactical teams and specialized 
resources to respond if needed. Because of our ready posture, we at the Washington 


Field Office, along with other FBI assets, were positioned to deploy resources and assist 
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immediately. 

Like you, | was appalled at the violence and destruction we witnessed on 
January 6th, violence that was targeted at our elected leaders and government 
employees, including our fellow brothers and sisters in law enforcement. | can assure 
you, we remain focused on getting to the bottom of what happened that day. 

At the FBI, our goal is to always disrupt and stay ahead of the threat, and we are 
constantly trying to learn and evaluate what could have been done better or differently. 
This is particularly true when we see something on the scale of January 6th. | want to 
underscore that, as you will see from my discussion of WFO's preparations, we made 
considerable efforts to identify and mitigate threats related to January 6th. We did not 
treat it as business as usual. 

As you are aware, all FBI investigative activity must have an authorized law 
enforcement, national security, intelligence, or public safety purpose. At the F -- the FBI 
may not engage in investigative activity solely to monitor the exercise of constitutional 
rights, such as the free exercise of speech, religion, assembly, or press. 

The FBI routinely participates in planning related to large-scale events in the 
National Capital Region, including those events designated by the Department of 
Homeland Security as national special security events, or more commonly called an NSSE, 
for which there are specific protocols and roles for the Department of Justice and its 
components. 

Traditionally, the Metropolitan Police Department, United States Capitol Police, 
and United States Park Police take the lead in planning for demonstrations, such as those 
planned for January 6th since the security and protection of the city, the Capitol, and the 
relevant Federal land falls under the purview of those agencies respectively. 


The FBI in not -- is not itself a police department. But in the event of large-scale 
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demonstrations, the role of the FBI generally includes dissemination of relevant threat 
intelligence information to partner agencies, the investigation of potential Federal 
criminal violations, or threats to national security and the mitigation of those threats. 
Additionally, if partner agencies request authorized assistance, the FBI provides tactical 
assistance for specialized incident response. 

Though the anticipated events of January 6th had not been designated as by the 
Department of Homeland Security as an NSSE, the Washington Field Office leveraged our 
past experience preparing for an NSSE. As part of this process, we analyzed intelligence 
to proactively prepare and alert our partners at the Federal, State, and local levels to 
potential threats of violence and criminal activity. 

This was, in part, because the NSSE planning for the upcoming Presidential 
Inauguration was underway, and we were already in frequent communication with our 
partners about the threat picture in the national capital region. Washington Field Office 
is also uniquely positioned within the FBI by virtue of our office size and our depth of 
experience with the type of activities that regularly occur in the D.C. area for events of 
this scale. 

Well in advance of January 6th, the FBI prioritized collection, sharing, and 
dissemination of intelligence with our law enforcement partners. Throughout 2020, the 
FBI issued approximately a dozen external intelligence products to our partners, 
specifically raising concerns about domestic violent extremism, including concerns about 
domestic violent extremism related to the election, and related to domestic violent 
extremism continuing past Election Day itself, right up to the time of the certification and 
the inauguration. 

Throughout these products, raw intelligence was shared with Federal, State, and 


local partners warning of the threat posed by domestic violent extremists, including the 
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potential for increased violent extremist activity at lawful protest events. 

For example, in June of 2020, the FBI issued two separate joint intelligence 
bulletins highlighting the potential for increased violent extremist activity occurring 
during lawful protests taking place in communities across the United States. These 
products have already been shared with the committee. 

In the weeks leading up to January 6th, Washington Field Office participated in 
numerous frequent coordination meetings and partner calls with other Federal, local law 
enforcement agencies, including the Capitol Police and Metro Police Department, that 
focused on threat intelligence sharing and planning relating to the election and the 
inauguration. These discussions focused on each agency's operating posture in light of 
the planned events on the 6th, including the tactical assets that would be available in 
support of other agencies. 

As a general matter, the FBI receives tips and intelligence from various sources, 
and we must assess the credibility and viability of information under the laws and policies 
that govern the FBI investigations. The FBI's National Threat Operations Center serves 
as a primary communication channel for the public to provide information on Federal 
crimes and threats to national security. 

Information of lead value has been provided to the appropriate FBI field office or 
law enforcement agency for action. Of course, the FBI cannot and does not investigate 
groups or individuals based solely on the exercise of First Amendment-protected activity. 

In the weeks leading up to January 6th, the FBI engaged all 56 field offices to 
collect information on threats to the National Capital Region, and engaged in mitigation 
activities based on the potential for threat activity. Field offices were asked to canvass 
their confidential human sources for any reporting regarding the potential for violence 


related to the election or the inauguration. 
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Washington Field Office, along with the other FBI field offices and field FBI 
divisions, actively monitored threats related to January 6th, and shared threat 
information with our partners. Our analysts worked tirelessly to perform preliminary, 
open-source analysis to identify any threats of violence or criminal activity related to 
potential protest activities in the national capital region, and to share these threats with 
partners as appropriate, including information posted online. 

The timing coincided with the expiration of the Bureau's contract with an existing 
social media tool and the awarding of a contract to a new provider that began on 
January 1, 2021. Although this transition and its timing was a challenge for the 
Washington Field Office, my team was absolutely focused on any actionable intelligence 
that was being posted online. 

We had an open assessment that under our investigative guidelines gave us 
authority to identify, obtain, and utilize information about actual or potential national 
security threats, Federal criminal activities, or the vulnerability to such threats or 
activities. 

In addition, we created a specific Guardian tag, cert unrest, on December 27, 
2020, to track Guardians related to the election certification on January 6th. A Guardian 
assessment is a process by which the FBI examine incidents to determine where there is a 
nexus to terrorism, cyber, or other criminal activity to warrant further investigation or to 
apply additional investigative resources as determined by the attorney general guidelines 
and FBI policies. The "cert unrest" tag allowed us to quickly see all Guardians with a tag 
across the Bureau, even if the Guardian was assigned to a different field office. 

In addition to the "cert unrest" tag, Washington Field Office was also running our 
own keyword searches in the Guardian system to see other Guardians that might be 


related to January 6th but that did not have the "cert unrest" tag. 
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Again, as you've seen from the Guardian email summaries that were circulated by 
the Washington Field Office in advance of January 6th, we were not only looking at the 
Guardians assigned to Washington Field Office; rather, we were actively engaged with 
other field offices and our law enforcement partners about the information we had. 

The process included conferring with field offices that had opened investigations 
on predicated subjects who had expressed an intent to travel to Washington, D.C. for 
January 6th. For these travelers, the relevant field offices were asked to prepare 
mitigation plans based on the facts of the specific investigation, and, of course, being 
mindful of an individual's First Amendment rights. WFO was in frequent contact with 
the other field offices and FBI headquarters regarding these subjects. 

As | mentioned a moment ago, but it bears repeating, we were also in 
frequent -- and | do mean daily -- communication with our Federal and local law 
enforcement partners, including the agencies responsible for leasing Washington, D.C., 
the Metro Police Department, and securing the Capitol, the Capitol Police. 

During this time, while we and our partners were aware of and certainly planned 
for a response to potential violence in the national capital region on January 6th, WFO 
was not aware of actionable intelligence indicating that people would storm the Capitol 
Building. 

In our review to date, across the Bureau, there were several dozen pertinent and 
specific Guardians open in advance of January 6th. This means that these Guardians 
included a reference to January 6th, Washington, D.C., and either the U.S. Capitol or 
specific threat of violence. The majority of these resulted from public reports; others 
were referrals from law enforcement partners, FBI headquarters, or from CHS, 
confidential human source reporting. 


The majority of the Guardians originated from social media platforms. With 
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respect to the disposition of these Guardians, nearly half were open as Guardian 
assessments, several contributed to opening a new predicated investigation or 
contributed to an existing predicated investigation, and the rest were closed for 
information only. 

As a general matter, Guardians may be closed for information only based upon a 
lack of specificity, a lack of a criminal allegation, designation as protected First 
Amendment activity, or because there is insufficient information to identify the subject. 
Closing a Guardian does not mean, however, that the information is not shared with our 
partner. 

Of these Guardians, fewer than half were assigned to WFO specifically, roughly 15 
were closed for information purposes, roughly three were converted to assessments in 
advance of January 6th, and one Guardian assigned to the Washington Field Office on 
January 5 was open on January 6th. ‘It was linked with another field office's Guardian 
and supported a subsequent full investigation. 

Being mindful of information that may be tied to ongoing investigation and 
prosecutions, | am ready to discuss a snapshot of the Guardians that WFO was tracking 
most closely leading up to January 6th. Allof these preparations supported and 
culminated in the establishment of two FBI command posts in advance of January 6th. 
Briefly, command posts are established to facilitate rapid information sharing with 
briefings provided to all participants on a set schedule or as warranted. 

The FBI activated its National Crisis Coordination Center -- you'll hear it referred to 
as "NC3" -- on January 5th at FBI headquarters. The NC3 included multiple FBI 
headquarters divisions, as well as representatives from Federal partners, including DHS, 
the Department of Defense, the Department of Justice, and U.S. Park Police. NC3's 


purpose was to collect, analyze, and share intelligence with law enforcement partners so 
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that every agency in the command post had a common operating picture. 

In addition to the headquarters NC3, Washington Field Office stood up our own 
interagency command post, which also activated on January 5th. Washington Field 
Office's command posts included representatives from Capitol Police, Park Police, Metro 
Police Department, and Secret Service, all of whom were co-located in the Washington 
Field Office's dedicated command post space so that information intelligence could be 
shared in real time. 

Our command post at Washington Field Office was connected virtually to the NC3 
for briefings and other information sharing. On the evening of January 5th, we 
instituted regular briefing cycle for sharing threat intelligence and other pertinent 
information with immediate threats being shared as they were received. 

These command posts were in addition to the presence of task force officers on 
the Joint Terrorism Task Force and FBI employees embedded throughout the U.S. 
intelligence community to share intelligence information with the FBI and their agencies. 
The FBI's national Joint Terrorism Task Force situated at FBI headquarters includes more 
than 40 interagency partners, including Capitol Police, and it's complemented with our 
JTF -- JTTFs in all field offices. 

Finally, in advance of January 6th, the Washington Field Office, along with other 
FBI field office and headquarters divisions, were prepared to quickly respond if and when 
incidents occurred. As you know, this included two pipe bombs and numerous other 
threats or incidents around the city, in addition to the events at the Capitol. 

Specifically, at the Washington Field Office, three SWAT teams and our special 
agent bomb techs and evidence response teams were on active standby in the office and 
had representatives in the Washington Field Office command post, starting on 


January 5th. Two teams of SWAT operators from Baltimore were prepositioned in the 
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national capital region, so that in event they were needed, they could quickly respond. 
And a unit of the FBI's hostage rescue team was also on standby. 

Throughout the course of the day, on January 6th, the FBI remained in constant 
communication with our Federal, State, and local partners, including through the 
Washington Field Office and NC3 command post. 

| hope this has provided a helpful overview of the WFO's mission, role, and 
preparation in advance of January 6th. | will close by repeating what Director Wray has 
said, that the FBI is committed to learning from the events of January 6th to be sure that 
nothing like what happened at the Capitol ever happens again. 

Since January 6th, for instance, we have made improvements to ensure the 
intelligence is shared with our partners at the proper level, from the bottom up and from 
the top down, to ensure that decision-makers are equipped with the best, most recent 
information, and we have continued to prioritize domestic terrorism investigations to 
develop sources and intelligence in our effort to stay ahead of the threat. 


I'll now be glad to take your questions. 


Sea Thank you very much. 


Just for the record, | wanted to state my colleague, P| investigative 


counsel for the select committee, is also in the room. 
EXAMINATION 
BY MR. 

Q Ms. Moore, can you tell us, start just -- and you kind of mentioned it in your 
statement, so | may be going over some of the same material. Where do you work 
currently and under what title? 

A Currently, | serve as the executive assistant director for the human resources 


branch stationed at FBI headquarters in D.C. 
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Pp 


When did you start as that title? 


> 


In this title, | started in June of 2022. 

Q And what precipitated the move? 

A Prior to this position | served as our assistant director of the security division, 
and | was named that in July of 2021. 

Q Okay. | guess, | meant to say, why did you make the move? Why -- why 
did you go over to human resources? 

A | was asked by the Director to serve in that capacity. 

Q Okay. Where did you work back on January 6th of 2021? 

A January 6th of 2021, | served at the Washington Field Office as a special 
agent in charge over intelligence. 

Q Okay. And when did you assume that position? 

A | assumed that position in October of 2019. 

Q__ Sois it fair to say, then, you left that position July of 2021? 

A  lIdid. 

Q Okay. Perfect. May you briefly describe your professional experience 
leading up to your time as the special agent in charge of the Intelligence and Incident 
Response Division at Washington Field Office? 

A | entered the Bureau in 1995 as a professional staff employee, supervisory 
level, in the San Diego field office. In 1998, | was selected as a special agent, attended 
Quantico. | hada first office assignment in the Dallas Field Office, where | specialized in 
public corruption. 

From Dallas, | returned to FBI headquarters, worked in our inspection division. 
From inspection division, | was selected to serve as a resident senior agent, or senior 


resident agent, at the Las Vegas Field Office in northern Nevada overseeing Reno, Elko, 
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and South Lake Tahoe resident agencies. 

From there, | returned to Louisville, Kentucky, or | went to Louisville, Kentucky, 
where | served as the criminal assistant special agent in charge. From there, | returned 
to headquarters as a senior executive service in the security division. And from that 
assignment, | went out to Washington Field Office. 

Q Okay. Let's talk about the Intelligence and Incident Response Division. 
Can you just tell me, what does it do? 

A At the time of January 6th, so as we back up a little bit, so when | took 
possession of that branch or leadership role, it was just the intelligence division. It 
became the Intelligence and Incident Response Division in late March of 2021. And in 
that capacity, the branch oversees the intelligence production for the national capital 
region, our area of responsibility, which largely covers a portion -- I'm sorry -- of Virginia 
and all of D.C. Metro. 

Q___ Sois it fair to say, then, when you took over as the special agent in charge 
you hadn't worked in that branch, that division previously? 

A No, sir, | had not. 

Q Okay. Talk to me about the Washington Field Office in particular. Is it 
different in structure, or play any different role given its location in the national capital 
region versus other FBI field offices around the country? 

A So the Washington Field Office is what we call an extra-large field office. In 
the Bureau, there's three of those: New York, L.A., and Washington Field Office. So by 
Bureau's size, we're numbertwo. That makes us significantly larger than, say, our 56 
Field Office Alaska, right, who has 54 special agents. 

So in the Dallas Field -- or, excuse me, in the Washington Field Office we have an 


assistant director in charge, and then under that, we divide up the branches of 
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responsibility amongst five special agents in charge. Comparing that to like a Dallas, 
Dallas will only have a special agent in charge, so one SAC over that. Because of the 
concentration of violations and people in the AOR, we have such -- a much larger 
footprint. 

Q_ And in particular, as special agent in charge in charge of the intelligence 
branch, what was your role? So just give us a little bit of your job -- a job description of 
your post. 

A My job at that time oversaw obviously all of our intelligence production, that 
would be our roughly 100 intelligence analysts, 75 support operations specialists 
specifically assigned to intelligence, our human source, or HUMINT developed handlers, 
our covert surveillance, and our linguists. 

Q  Andwho was your direct supervisor at the time? 

A Atthe time that | took over, or the time of January 6th? 

Q Let's talk about, yeah, the leadup to January 6th and the 6th itself. 

A When | was first assigned, my assistant director in charge | reported to was 
Timothy Slater. In October of 2020, it changed to Steve D'Antuono. 

Q And you got into this a little bit, if you could just talk to us about how your 
team is divided, the structure of the intelligence branch and how labor is divided among 
them? 

A So for the intelligence branch, | have two assistant special agents in charge. 
We also callthem ASACs. One specifically handled all of my covert surveillance assets, 
lookouts, those type of classified things. My second assistant special agent in charge 
handled all of our HUMINT operators and HUMINT development and a special technical 
platform that we have there that's classified way beyond this level. 


And then | have three supervisory senior intelligence analysts. Each of them 
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oversee a specific section of intelligence, so one is over criminal and national security, 
one is over counterintelligence, and one oversees what we call our coordination center, 
which looks at your AOR and how it's made up. 

Q AOR being area of responsibility? 

A I'm sorry, yes. | apologize. 

Q  Oh,no, you're fine. How many people total is that then in the intelligence 
branch under your supervision? 

A 600 roughly. 

Q How would you characterize the branch's relationship to intelligence; that is, 
are you mainly an intelligence collection division, intelligence consuming division, 
intelligence sharing division, all three? How would you characterize it? 

A We doallthree. So obviously we consume intelligence from our 
colleagues, our partners all across the Bureau. Wecollect it all and then we will analyze 
it and disseminate. So wedoallsorts of things. So we do both strategic, looking long 
term, and both tactical, looking at a specific cases and actual intelligence with that case. 

Q _Isit fair to say, because you just mentioned you collect from your partners, 
you yourselves are also primary collectors of intelligence? You don't rely just on your 
partners. Is that right? 

A Absolutely not, no, correct. 

Q Okay. Perfect. And!|guess, could you give me -- it may be a little bit hard, 
but give me a rough like breakdown of what you largely do. Do you feel as though you 
are sort of doing that primary collection, open-sourcing? Is that a lot of what you do? 

Is it more the sharing? ls it more relying on partners? Where would you say is the real 
thrust of your day in and out? 


A It is divided and depending upon the event or what is going on. So you may 
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have, as in January 6th or inauguration, we're sharing, right. We're collecting but we're 
sharing. We're collecting within the FBI and we're sharing it amongst Federal, local, and 
State partners. 

If we're doing a criminal investigation that's our end case, we're looking at that, 
gathering information that we can and feeding it to our investigators so they can execute 
oncases. So it's -- our investigators are special agents. So it really is divided 
depending upon the specific assignment at any given time. 

Q Do you find that as the, you know, FBI, you know, a Federal agency in the 
intelligence community, that your partners rely on you for disseminating intelligence that 
you yourself have collected? Do you feel as though you're one of the main sort of 
disseminators of intelligence in the community or -- 

A | think the FBI is a primary disseminator of intelligence, but we are, by far, 
not the only one. All of our partner agencies, including Federal, all have an intelligence 
component. Everyone plays avery large role in that. | think at times we're just largely 
staffed or that could be perceived as that, but by no stretch are we the only one 
collecting and disseminating intelligence. 

Q Okay. And you described it a little bit, that it depends on the events, sort 
of, what you're more doing. And | think you talked about it a little bit, but can you get 
into more detail for me, how did it operate in terms of that division of whether it's mainly 
collecting, mainly consuming, mainly sharing intelligence in the leadup to January 6th 
itself? For that event, what would you say was the -- your branch's predominant role? 

A At that point, we were scouring all open-source media. We were operating 
under what's called a Type 3 assessment, which gives us legal authority to look like at 
open source on the internet -- we can't look at anything closed or that requires special 


memberships to -- gathering that intelligence and evaluating what was being posted out 
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there in social media to get atmospherics. 

Additionally, we were directing our agents and colleagues in other field offices to 
canvass their CHSs, their human sources, that type of information. So we were both 
collecting and disseminating regularly. 

Q Okay. 

A Like it was an on -- it's acycle. Like there's not one thing that you do in 
intelligence. It's a cycle, and it always has to happen, because if you just collect, that 
serves no purpose. You have to collect and disseminate. 

Q Okay. Sol wanted to talk about exhibit 19. | don't know that you have it 
in front of you. 

A Idon't. 

Q Oh, but | think we can provide it, so perfect. So19. Andin exhibit 19, 
Matthew Alcoke says in the thread, quote, "We're mostly packaging and passing along 
intel and observation from our partners," end quote. This was, | believe, in the leadup 
to January 6th. | believe it's either January 2nd, if I'm not mistaken. 

Do you need me to point to you where it is, or is that portion -- 

A | mean, you can quote it -- 

Q = Yeah,! quoted it. | don't know if that portion is familiar. | know for the 
record, we've given you the exhibits to review. 

A Yeah, | have looked at it before. 

Q Perfect. 

A So let me explain the difference. Well, go ahead and read the question you 
were going to ask me. 

Q Well, the question was going to be, in essence, is that accurate what you 


wrote there about what you're mostly doing, packaging and passing along intel and 


observation from our partners? 

A So let me explain, again, the setup at Washington Field Office. | am the 
special agent in charge over the intelligence division. My job is the collection, 
dissemination, and sharing of intelligence. Matt Alcoke is the special agent in charge of 
the terrorism division or the national security division. He does not oversee intelligence, 
so | think Matt, in a laymen's term, is using inappropriate wording for what we were 
doing. Maitt is not the intelligence SAC. 

Q_ Allright. So you disagree with his assessment there? 

Yes. 

Q_ iI'll keep -- with that caveat, | just have another thing to quote from him if 
that's okay. 

A _ That's okay. 

Q He goes onto say, quote, "Some of the DOD or Fed components may be 
better suited going direct with MPD, USPP and USCP" -- that being Metropolitan Police 
Department, U.S. Park Police, and U.S. Capitol Police -- "especially since our repackaging 
and passing along their info could put us in a tough spot." 

My question is just, what did you take that to mean, "better suited"? 


A So "better suited" is an -- again, this is for official use only, right, law 


enforcement sensitive type stuf. 
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So while we share that law enforcement information between each other, it puts 


us in a very difficult spot when the FBI is the one sharing the information that Park Police 
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has specifically asked us not to. [iS 


Again, as we go on, in light of this event, you'll see in our SITREPs that we do 


ultimately start talking about that, because it's very important for everybody to have that 
global picture. But we often wish that someone, instead of coming to us, would go to 
the source that would have that information. 

Q Okay. And so, the part of the quote that says some of, you know, DOD or 
Federal components may be better suited, do they not have those same concerns, law 
enforcement sensitivity concerns, or why would it be better -- why would they be better 
suited? 

A It's their information. 

Q Okay. 

So I'm resharing information that they have asked me not to share. 

Q Okay. You talked a little bit about how in the leadup to January 6th, you 
said that you still shared that information. There was -- you know, you prefer it to come 
from the direct source, but you still did it. Can you talk to me about whether 


there -- that reluctance, maybe -- you know, or -- or preference that it come from the 
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direct source, whether any of that affected things you might have shared leading up to 
January 6th? 

A No. 

Q Okay. 

A No. And I'm sure -- | have seen some of the exhibits that you're going to 
give -- you're going to present today. In there we talk about where we disseminate our 
SITREPs to, and that was one of the reason -- our situational reports. We tried to keep 
them inside on what we call a red system, a classified system, where all 56 -- | think 
it's -- I'm going to double-check -- yeah, 53 agencies are on our Joint Terrorism Task Force 
at the Washington Field Offices. So all 53 representatives and our internal components 
can see those SITREPs. But it's part of that, it's one of the reasons we try to control 
some of that dissemination. 

So all of our partners are getting it, all of our Federal partners are getting it, our 
State and our local partners are getting it, Department of Justice is getting it. But we're 
trying to prevent -- we're trying to at least control some of the dissemination so if that if it 
leaks into the media, which we had previously seen in the summer of 2020, like our 
SITREPs were straight up published, it could compromise, again, a source, put another 
agency in an issue -- a spot that we don't want to put them in. 

Q Any questions on this issue? 

Are there any restrictions -- I'm sure there are, so I'm asking it 
open-ended -- Federal or local that guide your collection of intelligence like other 
agencies within the intelligence community, so any sort of First Amendment concerns? 

A Oh, yeah. I'm sorry. 

Q Yeah, that's what! meant. Are there any things that like stop you from -- or 


considerations that you have that keep you from completely being able to -- 
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A We -- 

Q__ -- look into certain things? 

A People's First Amendment rights, obviously, are protected. We cannot 
troll -- can just troll the internet looking for things that's out there. We have to havea 
reason, so that's where | kind of briefly touched on. We had an assessment, it's the 
Type 3 assessment. Our domestic investigative operation guidelines of section L allows 
us to open a Type 3 -- | know, it's not very exciting, but our Type 3 investigation that will 
prohibit us from looking at anything that's First Amendment, but we can look for acts of 
violence that we think would come into play against a First Amendment-protected 
activity. So we are very limited in what we cando. Wecan only do that first level 
open-source, what's available kind of to everybody look. 

Q Okay. And when you say, you know, you can do the first level of looking, 
does that mean -- and you used the phrase you weren't aware of any actionable 
intelligence obstructing the Capitol. Is that next level what you mean in terms of taking 
action you can see, but then the action part is what stops you if it's pure speech, or what 
is the next step other than doing the preliminary open-source looking? 

A So that would be a Type 1, 2 assessment, and those are where we 
have -- where it's sort of like an onion, and we start peeling it one layer at a time, right. 
So the first is we're looking across that open source that we can do under that Type 3 
authority, so we're just looking. 

If something comes in that is more actionable, we enter those type of things into 
our Guardian system, and then we can open a Type 1 or Type 2 that's going to give us a 
little more authority. Again, it's another layer of the onion that we can do. 

We can go and interview a complainant, we can -- we can't necessarily task a CHS 


to go into a closed forum, but if they're already in that forum, they can provide passive 
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information to us that -- and it opens up more database checks that we can do. 

Q_ So but short of action, so seeking a warrant, interviewing a human being, 
knocking on a door, that sort of thing, are there any restrictions on using what you found 
in open source to put together a threat picture, to put together a joint bulletin, to put 
together a warning for your partners surrounding a certain event? Is there anything 
that stops you there, even if it's purely First Amendment speech? 

A So, no. That would be what we would be disseminating up to January 6th 
is the atmospherics of what we are seeing from our open-source information and SOMEX, 
social media exploitation. That's what we're sharing in all those partner meetings, 
briefings, that type of thing. 

Q_ And if you could just speak a little louder for our, | guess, people on the 
Webex. 

A Sorry. 

Q__I'mtold we're both maybe being a little too soft-spoken. 

So is it fair to say, then, those sort of First Amendment concerns, those sort of 
restrictions really deal with cases, opening up cases, acting, like | said, in terms of 
warrants, knocking on doors, interviewing, and less so on creating threat pictures, 
assessments, that sort of thing? 

A Again, we can search open-source social media, not for First 
Amendment-protected activity, but if there's violence that's going to be directed at that 
First Amendment type activity to get that atmospherics, correct, and that is the type of 
briefings that we were providing leading up to January 6th. 

Q You've talked about your partners. Can you just tell us, you know, who do 
you generally share your intelligence with? 


A So we have 53 partners on our Joint Terrorism Task Force at the Washington 
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Field Office, so that's Metro Police Department, United States Park Police, United States 
Capitol Police, the Supreme Court Police, the Metro Airport Authority, Department of 
Defense entities that are on it, Department of Homeland Security entities that are on it, 
United States Secret Service. Ultimately, we have partners in Virginia, like Fairfax 
County Police Department, Arlington Police Department, on and on, the list will go to 54. 

Q Okay. And are -- are those the same folks you receive intelligence from as 
well? 

A They are. 

Q What about your relationship with DHS I&A? 

A In what regards? 

Q  Doyou guys share intelligence or do you share with them? Do they give 
back to you? Do you have a relationship in that capacity? 

A They are not part of our Joint Terrorism Task Force collaboratively. Let me 
talk to my counsel for a minute. 

[Discussion off the record.] 

Ms. Moore. Sorry. | was confused by that question. So we have Department 
of Homeland Security assets that are within our task force. So those Department of 
Homeland Security assets are responsible for sharing that information back to their 
colleagues and counterparts within their agencies. | mean, we're not precluded, but 
they're not that first avenue because they've assigned people to our task force. Does 
that make sense? 

BY MR. = 

Q Sure. 

A Sorry. 


Q  No,ofcourse. And I'll get into a little bit more also about fusion centers, 
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but what about the fusion centers around the country? Do you guys have a relationship 
with them? 
A We do. 


Q = Doyou share intelligence -- 


A We do. 
Q- --andalso receive intelligence from them? 
A Correct. We have imbedded bodies at the fusion center in Virginia and the 


consortium in Washington, D.C. 

Q How much of a role would you say they played in terms of the intelligence 
you received in the leadup to January 6th? 

A If they had intelligence that they shared with us, we would've brought that 
in and been consumers of it and married it up with the intelligence that we had. 


Q_ Are you aware of information that was sent to the Washington Field Office 


re 


A lam. 

Q Okay. So--andsol kind of want to get the idea of when tips or 
information even from outside sources, externally, when they come to your branch, does 
it make it past your desk or how -- what makes it up to you? 

A Oh, absolutely -- 

Q Okay. 

A -- that came right to my desk. And think you have that in your exhibits, so 
we can talk about that. When that comes into us, for that, because it was coming from 
some closed forums | actually -- I'll seek legal advice and opinions, because | definitely 


don't know everything legally, and that's when we have legal advisers, to make sure that | 


24 


25 


28 


can take that intelligence in and how | can exactly consume that. 

We can absolutely take in that type of information. It becomes very difficult to 
validate it if it's from a closed source. And we have to be very careful, even as we 
consume any information from whatever source that is, because a lot of times, people 
have their own political agenda, they want to show only a fraction of something. 

It's not unusual for us to get, like, from social media a clip of a thread but not the 
entire thread, because this little clip will -- you know, taken out of context sounds much 
more inflammatory. Sowedotakeitin. Weassessit. Werunitdown. We have to 
verify every single thing that's sent to us, so no matter who sends it to me, | still have to 
turn around and verify that | see that for myself. 

Q_ And interms of verifying, you know, testing its validity, is that the step that's 
required in order for you to push it out, or is that even a step required for it to be put into 
the system whatsoever? What is that? 

A Sowe have different means for dissemination. It's an endless number. 

It's about 160 different intel-type products that we can produce. Some are strictly for 
internal or some is external, so it kind of depends upon where you're getting -- like if 
we're sharing that information out. But are you asking me specifically to the 
information she provided? Let me have you ask me that again. 

Q  Yeah,sure. | guess what I'm trying to get at is, what are you validating it 
for in order to push it out? In order to put it into your system? In order -- what is the 
goal of -- what will happen to it if you can't validate it versus once you do validate it? 

A Everything goes into our system. 

Q Okay. 

A So there's no not going into our system. So we can always go into our data 


lake, for lack of a better word, it's always searchable, retrievable. If there's something in 
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there that hits on key words that when we're looking at something else and it makes a 
bigger picture, it's absolutely in our data lake, without a doubt. 

But we may not be able to positively verify that the information is complete that's 
been givento us. So we may not see actionable again, and that is we're not able to do 
specific investigative techniques further on the information provided other than allow it 
to build an atmospheric position -- a picture, not position. 

Q Can you give us just a little bit of like a rundown of the differences between, 
you know, Guardian, eGuardian, SENTINEL, that sort of -- 

A Sure. So let's start first -- well, let me see. How dol want to build this? 
SENTINEL. SENTINEL is our official record system. That's where all the cases, 
everything resides. But also, your Guardians and stuff reside in there, but I'm going to 
build you that. Like, so SENTINELis our mothership. That's where it all happens. 
That's the big boy. 

So we come in and Guardian is two terminologies. It's a system, and it's a term, 
if that makes sense. So like we call it the Guardian system, so it's a different database, 
and then we say, Oh, that's a Guardian. So it's kind of weird, and really a Guardian is 
just an assessment or a pre-assessment, but they just misuse that term regularly. | don't 
know. We like the word "Guardian" apparently. 

And so the Guardian is a database, and that's where we can take intips. They 
can come from other law enforcement agencies, and that's called an e-tip or eGuardian, 
and they can putinatip. It will come into our system and go to our National Crisis 
Operations Center, NCOS, out in West Virginia, and they're going to assess it and then 
send it back out to the right field office. 

Again, a generic person from the public can call in a tip to our (800) number. 


That's going to be triaged out in, again, West Virginia at our NCOS. They're going to put 
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it, the tip, into the Guardian system and then push it out accordingly to the area of 
responsibility that they think it comes to. 

We can take in walk-ins that walk into any of our 56 field offices, our 300 sub 
offices, or 76 international offices even. If they come in and they give us a tip, it'll -- our 
agents can go in, open the Guardian system, and put the Guardian in and it will push 
through the system where it's supposed to go as well. 

Ultimately, that system feeds into our SENTINEL system, the big ship, is that we 
just work it -- it makes it easier for us to break out that raw information that we're 
handling in the Guardian system. Does that kind of give you a picture? 

Q Yes,itdoes. Thank you. 

A Okay. 

Q_ And|think you -- 

A Because | can go deeper. 

Q_ That's good. That's surface level. That helps. 

And | think you mentioned that the -- there's no -- so then there's no standard 
that -- for uploading. Every single tip is uploaded to the Guardian? 

A Everything is taken into a Guardian, correct. They're put into the Guardian 
systems, correct. There are things that can be a poison pen, spaceships, stuff like that 
that's not going to make it to a Type 1 or a Type 2 assessment, but they're still in there 
that can be searched. 

Q = And who's making that determination as to whether it will go to a Type 1 or 
Type 2 assessment? Who are those people? 

A Special agents. 

Q Okay. 


Mr. Can | follow up before you keep going All 
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Vr. Yes, please. 

aye | 

Q I'm just trying to understand, Ms. Moore, the First Amendment restrictions 
and whether they apply similarly to things that agents of the Bureau are affirmatively 
gathering themselves by social media monitoring versus stuff that is submitted from 
other sources. | understand there are restrictions that the FBI is only going to, when 
there's a Type 3, review open source. 

But yO is not an FBI agent and she's in a chat room or in a place that 
is not open source, and then sends something to you, do you apply the same First 
Amendment analysis to that information, or given that it's not coming from the Bureau, 
do you ingest that without restriction? 

A We refer -- we would ingest it, but we would also confer with our legal to 
make sure it's something that we could take in legally, like we're just making sure that 
we're not -- that she hasn't been inappropriately tasked by somebody without authority 
or anything of that nature. But, yeah, we're going to take it in. 

Q Yeah, | guess that's what I'm trying to understand is what -- what that review 
looks like. | completely understand that the FBI has these restrictions about its own 
affirmative extraction of information from online sources. But you have confidential 
human sources, and you have people that are directing information from all different 
sources who are not governed by those same First Amendment restrictions. 

And I'm just trying to get a sense as to what level of review that information, 
coming not from FBI agents, but from tipsters, confidential human sources, experts like 
| kind of review is that information subjected to? Is it the same First 

Amendment analysis or is it somehow different? 


[Discussion off the record. ] 
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Ms. Moore. It is the same process in the sense that it comes in, it gets put into 
the Guardian system, and analysts will do our initial triage of it or an agent can grab it and 
triage it as well. We're going to do certain database checks. 

We're going to try to verify -- like, so for every -- let's put hers to the side. Every 
screen grab somebody sent us during the leadup to January 6th, we have to verify that 
screen grab, where it came from, can we search it backwards, can we find out who the 
poster was, do we have the ability to do that. So giving us a screen grab of something 
salacious, we've still got to run that down just the same as anything else. 

BY vr 

Q But how do you run that down if you have these First Amendment 
restrictions that prevent you from going into the forum in which that -- 

A And sometimes we cannot. 

Q So hypothetically, Mr. X sends you a screen shot of something that's ina 
private room or a chat room or an encrypted channel that an FBI herself could not go 
into, you -- how do you then verify that or how -- what -- how do you determine whether 
or not that screen grab is legitimate if you have the inability to follow the track all the way 
into that private forum? 

A And therein lies the crux of what we do and the difficulty. So we would 
have to have legal authority to get into that forum. If we don't, we try to verify it with 
anything else that we have within our holdings, but sometimes we're unable to action it 
because we don't have authority to go into that private chat room. 

Q Can that screen grab itself become the predicate to give you authority to go 
into the chat room? In other words -- 

A If it's strong enough, and that's a high legal level -- | can't feel like, | can't 


think, it sounds like -- it has to be very specific information that will rise to a level that we 
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can obtain legal authority. And you've got to remember, to go into a private chat room 
is basically an undercover authority to us. 

Q_ Right, exactly. 

A So it is no small hurdle that we've got to get across. 

Q So hypothetically, if the screen grab says here's someone who is expressing a 
specific intent to storm the Capitol -- 

A Correct. 

Q_ --that, in and of itself, could be sufficiently specific actionable to itself, 
justify FBI entry into that chat room? Is that process possible, the tip itself provides the 
cause for you to go into a level deeper and monitor that channel? 

A It would have to be an amazingly detailed tip with such specificity that it 
would give us that legal authority. It has to -- our -- we are charged, as you know, with 
the least intrusive method possible to absolutely honor people's First Amendment rights 
for free speech, right. And so that's that whole onion-peeling-back thing that keeps us 
directly in our legal lane. 

So it would have to be with such specificity and such planning and such detail that 
we would be able to open a case, immediately seek authority for an undercover, have 
enough probable cause for that undercover off of one tip would be tough. 

Q Okay. The other example, let's say that that tip isn't sufficiently specific, or 
credible, for it to result in FBI further action, what happens to it? It gets, you said, 
logged into your system somehow. 

A Absolutely. 

Q Does it get disseminated to partners? 

A It absolutely can. Even if we end up putting something in for informational 


purposes only, it absolutely is shared, and you'll see that. Like in our SITREPs, we're 
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listing Guardians out that were for informational purposes only, because maybe 


somebody else has got something better than I've got, and maybe they can take what | 


have and add something to it and come back to me on it and be like, Hey, | got this. | 


didn't think it was important, but then | saw what you have. 


Q 


So everything that comes in from any source, whether it's a confidential 


human source, 1 0 ea wherever, it all goes in, it's all logged, it all goes in 


and then potentially gets disseminated to all the partners, the 53 partners? 


A 
Q 
A 


Q 


If it's related to a specific event -- 
Sure, yeah. 
-- it could, yes. 


And the only way the FBI would take further investigative action is if either 


some independent corroboration occurred or the tip itself was sufficiently serious, 


credible, that it provided predicate for further investigation? 


A 


Q 


A 


Q 


Yes, sir. 
That's a general summary? 
Yes, sir. 


Okay. Allright. I'm sorry to interrupt. 


Ms. Greer. Can say one thing? 


Ve. Yeah. 


[Discussion off the record. | 


Ms. Moore. Well, and | think what my counsel's suggesting is that anything takes 


legal authority. Legal authority takes time. Soa lot of this stuff that was coming in 


you're talking about very intimately close to the date of January 6th to run some of that 


stuff down, which we were doing as hard and as fast as we absolutely could. 


But also remember, if it's like a Parler, an overseas nexus, even if we serve legal 
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authority, we're not getting anything back. They're not going to provide it. And even 
as we go through, we have to go through our -- you know, our layers and our steps that 
we may ask for subscriber information, and the subscriber may come back to us as "JoJo 
the Clown." It may not give us anything that we can go further on. 
BY MR. J 

Q Yeah, no, | totally understand that. And I'm sorry to keep interrupting you, 
but -- so the decision about whether or not there's -- it is sufficiently specific, credible, is 
that a decision made by legal? Is that a decision made by the intelligence special agent 
in charge? Like who -- who makes that decision? Who's involved in the -- 

A Everybody. It can be everybody depending upon the information that's 
received, depending from where it comes. You're definitely -- you know, we're 
always -- legal is going to weigh in on what we're doing without a doubt. We have 
specific legal advisers assigned to each of our specific branches that specifically specialize 
in those areas that report under a general counsel for our field office as well. 

Q Yeah. And that takes time, | would think? 

A It does, but like in this instance, | mean, we're running hard. Weare 
fully -- | mean -- and | want to take you back, too. This is COVID, and we have everyone 
in. We're not working remotely. We're not signing in. | mean, we have people in the 
offices work -- working, spread out as much as we can, but we're in there doing this. 


There was no calling it in from the field. 


vi Okay. |X | apologize. 
YR 


Q No worries. 
We've been talking a little bit hypothetically, and in terms of what was sent to you 


guys COC did you find that that was a lot of running it down but having 
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trouble verifying it, if you recall? 

A We were going to require some legal -- a lot of that was from closed forums, 
if | remember exactly. I'd have to look at the exact post. I've looked at a lot of things 
in the last several days. Again, but | do know that that was from closed forums that we 
did not have access to. 

Q Okay. And sodo you know if a lot of those got pushed out to the 
partners -- or your partners or because of the lack of sort of being able to verify and 
validate it, it did not? 

A No, again, we would share stuff even if we couldn't. We shared 
information. | can't tell you exactly how her information was shared. | don't believe 


we were the only recipients of her information either. 
oy Me 
Q_ Sol'm getting the sense that the > is an example. 


Everything is going to get disseminated. But the only way the Bureau is going to do 
something, is going to actually take an investigative step, is if it meets some sort of legal 
review threshold of corroboration. Is that accurate? 

A No, no, no, no. So it has to have something actionable init. So really, 
that's the point. It has to have an actionable level that is not based off of a First 
Amendment activity or someone's national origin, race, ethnicity, or anything of that 
nature, so no protected element. But if it has something that we can action, we will, 
even if it comes in as a general tip. 

So let me go back to the Guardian system, right. We're going to go back and 
we're going to play inthat pool some more. So it comes in and it's considered a 
pre-assessment, so everything that gets put into the Guardian is entered into a 


pre-assessment. All of those pieces have baseline checks that have to be done and 
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that's numerous checks. 

It's like we're going to run it against our own holdings, we're going to run it against 
DIVS, we're going to run it against whatever is appropriate in that instance to run it 
against, and it's alot. And there's certain -- certain database checks that we just 
absolutely require. So like if it's the social media, we're going to run it against a tool 
that we have, right, to see if we can get any other monikers or anything else attached to it 
to start building actionable things that we can take action on. Sometimes, 
unfortunately, we can't. 

If it is something and it rises -- like, all right, yeah, we've now got subscriber 
information, we can take that, we're opening it now as a Type 1, Type 2 assessment. 
With that comes more authorities, right. So now | can serve legal process, again, only 
for very specific subscriber information, not details of phone calls or anything of that 
nature. |can go out and do more interviews. | can do -- like in a pre-assessment | can't 
go interview the subject. | can interview the complainant. | can interview witnesses, 
but | can't interview the subject. 

Ina Type 1, Type 2 assessment, that's where | can start interviewing more people. 
It gets a second layer. l've got more authorities. I've got more databases that | can 
check that type of stuff. 

Q Yeah. 


A Does that help a little? 
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[11:05 a.m.] 

We | think this will make more sense when we get into the actual 
information itself. We're just trying to get a sense hypothetically, generally how it all 
works. | appreciate it. 

BY MR. 

Q_ Sosticking with the Guardian system, who has access to it? Whocansee 
what's inside? 

A All FBI employees and task force officers that have a need to know. So, 
like, maybe like an FBI employee that's an gardener isn't going to have access to the 
Guardian system, right? But you're talking about operational entities, intelligence 
entities in our task force offices. 

Q Okay. So that includes different branches in the FBI? 

A Yeah. 


Q- Andas well, of course, as headquarter versus -- 


A Correct. 
Q_ --not just the -- and maybe a field office even in California? 
A Oh, yeah. Every -- yes, every field office. And our Guardians aren't just 


limited to national security, so they can be criminal, cyber, national security, 


counterintelligence, any type of things that come under Guardian. 


38 


Q_ And you talked about that sort of first level pre-assessment an agent is doing 


so that it's looking at individual tips that are comingin. Is there anyone tasked with 
viewing the information for patterns and trends looking across? 

A That's what our analytical cadre is doing. 

Q Okay. 


A So we have analysts assigned to each squad. And inthe event of January 
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6th, we had a very specific analytical team that was charged even going -- so that's why 
we created that tag, cert unrest, right? So that tag, anything that comes in from any of 
our field offices that advertised across the country and to NCOS to, like, hey, if it looks like 
it's related to the certification of the vote, tag it cert unrest, and that way it would flag it 
to us and we could come over here and search it really easily. 

But in that same instance, just in case we had somebody that missed that memo, 
we had other analysts that were going through the system and do key word searches 
looking for anything else that might tag to January 6th, in case we missed it. So we were 
doing it both ways to try to cover all ends. 

Q And |know you mentioned in your statement that December 27, 2020, was 
the sort of first day for the cert unrest tag. Is that right? That's when it was created? 

A Yes. 


Q Okay. When did the review of that tag begin? 


A Well, that day. 
Q Okay. 
A As soon as somebody would tag into it, yeah, we're reviewing it. Like, we 


were ongoing. So this wasn't -- we had been looking at -- let's back up. Right? So 
we're already in posture for an NSSE, so we've come in out of a command post for the 
actual election vote. There had been two large rallies already, MAGA 1, MAGA 2. So 
we already had a little command post up forthem. We'd already been searching for 
intelligence related to them. And we're always searching because we're in an NSSE 
posture for the inauguration. 

So we're meeting regular with our partners, like once a week. We have 
subcommittees that are meeting once a week. We have briefs and phone calls that are 


happening every day regardless, just as part of the NSSE. And as you're talking about 
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the NSSE, because it's happening in Washington, D.C., what else are you seeing? What 
else are you seeing in the leadup to it? And so we're by proxy also immediately talking 
about January 6th and the certification of the vote. 

So in the Guardian system we don't start tagging it until that date. But we are 
already looking in the system for anything leading up to the inauguration, anything 
leading up to the certification. 

Q  Sohow many, | don't know, agents or analysts are assigned to the effort of 
reviewing the tag as things come in? 

A | don't have that specific number and the days leading up to it, but it would 
be -- we have multiple squads that were reviewing that. So the analytical 
components -- and we changed that, right? So as the atmospherics change, as things 
developed, as things became -- the rhetoric became more, we put more and more 
resources onit. Solcan't give you an exact number or an exact day. 

Q_ Andare they briefing you? 

A Absolutely. 

Q_ And how often are they briefing you as to -- 

A They're sending me emails, so | am getting any -- | think somewhere in the 
exhibits | have my SSIA who's giving me a rollup. And so what we would do, because we 
have done this since the summer, is, like, hey, if anything in our AOR, area of 
responsibility, is changing, we are going to brief that all the way up, like, right? Like, 
it's -- your action a lot of times is taken at your squad levels and you're always advising 
your uppers. But when it becomes like really much more rhetoric on social media, that 
type of thing, we are putting it into like daily wrap-ups, and they're sending them up to 
me, and then I'm pushing them on up to my assistant director in charge and across to my 


colleague SACs. 
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Q Okay. I'm going to get into now the leadup to January 6th. And you 
mentioned the first two MAGA marches, | would like to start with those two, November 
14th and December 12th of 2020. 

What was the threat landscape, if any, leading up to those events that you can 
remember? 

A So as everyone knows, the country was a little bit on edge. There was a lot 
of rhetoric, people were posting "stop the steal" and Make America Great Again. And 
then you had your counterprotesters that were also posting things. And so we're just 
monitoring those atmospherics. 

As we had seen in MAGA 1 and MAGA 2, we had set up what we consider a 
command post light, like, we had not comparatively to what we did for January 6th, but 
we had people in the office throughout the whole weekend and the days and weeks 
leading up to those, again, searching the media. Do we have a specific threat to this 
event? What does this look like? What are we seeing? What are the plans for this? 
Not trying to stop anybody's First Amendment rights by any stretch, but was there 
violence that was going to follow on. The country was ina very heated state. We 
were all aware of that. 

Q Sure. You mentioned, of course, the protesters and counterprotesters. Is 
that what the intelligence was telling you, that the violence, if there were going to be any, 
would be skirmishes between the protesters and counterprotesters? 

A That was what we were seeing in the media. And that's what we had 
previously seen leading up to that was that it would be protester-on-protester violence. 

Q  Dovyou recall if you detected or part of the threat landscape was anti-law 
enforcement sentiment? And this is just for those first two MAGA marches. 


A Again, | think we provided those to you. We provided, throughout the 
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course of the year, a dozen different intel products that we released to our partners, 
Federal, State, and local, specifically related to the increase in domestic violent extremism 
and violence on law enforcement officers. So yes. 

Q_ And, | guess, how would you characterize whether the intelligence was 
accurate, whether it was predicted, whether that was what was seen in MAGA 1 and 
MAGA 2, largely skirmishes between protesters and counterprotesters? 

A __ That is what we had seen in MAGA 1 and MAGA 2. Wehadarrests. We 
had, | believe, a stabbing. We had multiple guns seized during those marches by Metro 
Police Department, which isn't unusual. They seize guns in the city all the time. But 
that was traditionally what we had seen at that point. 

Q What about violence towards law enforcement, was that something that 
was seen in the first two? 

A We had seen that, you know, following back tothe summer. So then we 
had published that in the days leading up as well to be aware of that. And again, to set 
that stage as you're leading up to MAGA 1, MAGA 2, which then leads into January 6th, 
there was so much rhetoric on the internet, you're beginning to look for a needle in a 
stack of needles. There was so much rhetoric out there. So we're trying to filter 
through what is legitimate, what can we action, what can we do. So we were constantly 
running this. 

Q You mentioned the summer. Is the anti-law enforcement sentiment from 
the same groups, different groups? Are we talking about the social justice protests and 
their anti-law enforcement sentiment or, you know, obviously the ones who are, the 
"stop the steal" protesters? What do you mean that sort of you had already been on 
alert about anti-law enforcement sentiment, and does it matter which group is sort of -- 


A It doesn't matter. It's apples to oranges when you're trying to compare the 
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two different groups. But there was just a large anti-law enforcement. There was a lot 
of hostility just in general being -- a lot of it was like what we call sometimes keyboard 
bravado. Like, I'm sitting behind my keyboard, and | hate everybody, I'm going to, you 
know, kill police, but there's nothing, you know, oh, we should kill police, without very 
much specificity to it, just general verbose statements, and we're working our way 
through those. 

Q Sure. Because we've heard from certain law enforcement groups that it 
was surprising to see anti-law enforcement sentiment from the group in particular that is 
protesting the election that are on the "stop the steal" marches, because their ideology is 
more traditionally seen as pro-law enforcement, and there's a little bit of a false sense of 
security that the target wouldn't be law enforcement. 

It sounds to me that that is not something that either was a view within your 
branch or that you yourself held or was surprised by to see that law enforcement 
sentiment -- anti-law enforcement sentiment in the leadup to the marches and to January 
6th. 

A Traditionally in the country we have not seen people who dislike the police, 
but we haven't seen them necessarily always attack. We had seen a lot of growing 
sentiment and, for lack of a better word, at some degree a disrespect, right, for law 
enforcement in different entities. And | think with the election, there was a lot of 
rhetoric out there about who you can trust or who you couldn't trust to some degree, 
right? Like, everybody was taking a side, and everyone felt that everyone was ona side 
or another. There was no neutral party into it. 

Again, we had published an intelligence product prior to that about that domestic 


violence extremism and threats to law enforcement were increasing. 
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BY VM. 


Q When did your branch, your division first realize that January 6th would be a 
date of importance unlike in other election cycles where the election certification 
attracted little, if any, attention? 

A Okay. Sol don't want to keep saying the same thing over and over. 

We're monitoring it, because everything in the city at that time was hot, for lack of a 
better word, right? Every march was getting a different kind of attention that it had not 
seen previously. And it was this specific day was getting a lot of media attention anda 
lot of social media retweets and tweets about coming to see this event on the Ellipse. 

Q But do you recall -- it wasn't immediately after the election, right? 

A No. 

Q_ It was the election wasn't called until a week later. And then it took some 
time for anyone to raise a spectrum of January 6th meaning anything. 

A But, remember, we're doing MAGA 1 and MAGA 2. Right? After the 
election we're doing MAGA 1. And then right into December we're doing MAGA 2. So 
we're still searching our atmospherics through those two events. 

Q Okay. Well, so let me divide, then, the calendar at December 19th. 

A Okay. 

Q_ There's a tweet from President Trump, the "be there, be wild." So let's talk 
about before that tweet. 

Do you have, before that tweet, already an idea that January 6th is going to be an 
important event unlike in past years or not before -- before the tweet, let's say, if you 
recall? 

A | think we were more aware of it because there was so much disagreement 


after the election and the actual vote was certified, right? So that makes it different 
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than previous years. After the President said, "be there, be wild," obviously, he has a 
tremendous amount of followers, and that increased that social media retweeting of that. 
And then we began to see people -- we saw increase in hotel reservations and 
reservations for buses. 

Q_ Soit sounds to me that certainly in terms volume, there's an increase after 
the December 19th tweet. Is that correct? 

A _ That would be fair. 

Q Was there an increase in the severity of rhetoric, in violent rhetoric that you 
noted? 

A | don't think | can specifically specify to tying that to that exact date. There 
was violent rhetoric out there for a while. 

Q Okay. 

A But | will definitely say all rhetoric, again, increased as we got closer to 
January 6th. 

Q Okay. 

A On both sides. 

Q_ So the head of the D.C. Fusion Center told us they saw a tenfold increase in 
online violent chatter, particularly following the December 19th tweet. It sounds as 
though that's not the experience in your division necessarily. Was that something at 
least you had heard about from your partners or told about? 

A We were all talking together and sharing information of what we were 
seeing, that now in lieu of the inauguration, January 6th was building to be a much bigger 
event. | can't -- where the D.C. Fusion Center is saying tenfold, | can't tell you if it was 
fivefold or tenfold for us. | can tell you there was an increase. | can tell you we were 


taking it seriously. We were absolutely sharing with our partners, and we were talking 
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to them all the time about what everyone was seeing. And everyone was saying the 
same thing. 

And, again, remember, we're meeting multiple times a week as we prepare for the 
NSSE. So everybody's talking about, hey, what are you seeing for the NSSE. Hey, | got 
this January 6th event coming up. For us in the FBI, we had already decided that 
my -- within my division, as it got closer to January 6th, that we were going to stand up 
our own intelligence command post if nothing else so that we could make sure like we 
had done for MAGA 1 and MAGA 2. The rhetoric did increase. Of course, anyone who 
has that many followers, people are going to retweet. 

Q And |think exhibit 18 has there from December 30th, 2020, and a round up 
the notes say, quote, There is anticipation for large numbers as the January 6th -- for the 
January 6th event, especially as POTUS has discussed and promoted it. 

So when did you decide to stand up something at WFO for January 6th? 

A So we talked about January 6th being uniquely positioned in the national 
capital region. So we have very -- it's a very, very, very large division. And so we have 
a lot of special events, different things that we will run probably 100 command post a 
year because of events. So wecanrunacommand post for July 4th, for New Year's Eve. 
We can run a command post if we have a multiple subject takedown on an arrest that 
could go violent. 

So because we're so large, that's what we do. We run -- like -- and we're going 
to err on the side of standing a command post from my branch. That's how | always did 
it, because we're intelligence. It's up to us to consume, develop, and share intelligence. 
So people are looking to us. Our partners -- again, we have the 53 on our task force that 
we all are sharing information. And so we're going to be there. But it would have 


been after the tweet. Yes, for sure. 
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Q And we talked a little bit about how the President's tweet certainly increased 
the number of people who would be attending and the hotel stays, all of that, that that's 
a natural sort of causal link. 

Were you cognizant of the tension between the President and the Vice President 
leading up to January 6th? Was that something through open sources that you were 
either paying attention to or knew about, the sort of targets of January 6th in terms of 
the pressure campaign and the sort of -- the pressure that the President was applying to 
the Vice President, was that something on your mind? 

A | was aware that there was information in the media and in social media 
about this, yes. 

Q_ Anddid any of that concern you in terms of potential danger to the Vice 
President himself and potentially him being a target of any of the demonstrations or the 
anger of demonstrators as we approached January 6th? 

A _ Anything that the FBI would have gotten to holdings (ph) regarding a threat 
to life, we would immediately share appropriately with the responsible party. So in this 
case, Secret Service would have been -- shared any of that information that we would 
have received. 

Q Okay. But you don't recall anything specific that was -- on that that was 
shared? 

A | do not. 

Q Actually, a little bit of a tangent because we're on exhibit 18. As part of the 
permit highlights it notes that, quote, sounded like all six of these permits -- these are the 
permits near the Capitol Building for demonstrations -- were connected to one individual 
who was associated with "stop the steal," likely in an effort to skirt the maximum limit of 
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Was that something you were cognizant of heading into January 6th, and was it a 
concern at all that, first, you know, "stop the steal" has a little bit of a violent history, 
reputation, and, two, that sort of deception in trying to skirt the maximum limit by 
breaking up into individual groups, if you were aware of it at the time? 

A So we were obviously aware of it because it's our reporting that you have 
here. So, yes, | was aware of it. Had|seenthis before? | can't say that | had 
necessarily seen that before. | can tell you what we also saw was that we thought these 
events were going to happen on different dates. And then all of a sudden the different 
dates all came to the same date. So like maybe one was going to be on the 5th and one 
was going to be on the 6th or maybe one was going to be on the 3rd and one was going 


to be on the 5th, and then all of a sudden all the permits moved to the 6th. 


Vs | have a question. 
VV Go ahead. 


Q___|just wanted to go back to kind of the increase in the volume of what you 
were seeing after that December 19th tweet and you're aware of it. My question is, 
what was the plan when you're seeing this volume increase, in the sense of are you 
looking at it, your team looking at it, with the same eye towards is this a First Amendment 
speech, can we open up a case about this? Or is there a point during that period of 
time, the latter part of December of -- because there's a volume of it, even if there's no 
case to be opened up, what kind of a bigger picture of what might occur on January 6th? 

A That's what we do for every situation that we have. So January 6th, again, 
grew exponentially. We've kind of discussed that already, and we're seeing more and 
more and more. But we're always looking at it for that whole parameter. It doesn't 


change what we do. Our process remainsthe same. We evaluate the information as it 
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comesin. Wetrytoverifyit. If we can take action on it, we do, and we share the 
information with our partners to develop a threat fixture in our area of responsibility. 

Q_ Right. So the process that you described, it sounds like, is for each threat 
that you see, meaning independent of each other. But is there a process in place that's 
viewing it as a whole? 

A Yes. Again, that's where they're going through, and our -- we tag it so we 
can see everything that's tagged to that event, so we can see, as it grows, what's out 
there, what we're specifically looking at. | have that analytical component that's doing 
our social media exploitation. They're going through what they're seeing on social 
media. They're trying to see if we can verify it. 

But that's developing that threat picture. And that threat picture is what we're 
talking about every week, multiple times a week, as we were meeting with our partners 
regarding not only the inauguration, but anything else that's leading up to it. Thus, 
January 6th becomes the topic of conversation because it's the next [inaudible] event 
that we have on our radar. 

And remember, we also ran a command post for New Year's Eve, so New Year's 
Eve wasinthere. So we constantly are looking for that landscape all along, and we're 
always briefing what that threat picture is and looking at the totality of it. 

Q- Soit--I'msorry. It sounds like what you're saying is this is constant work 
that you're doing, right, within your position at WFO, from everything that's getting 
pushed to you, as part of that hashtag that you mentioned, right, the cert unrest hashtag? 

A In that for -- that in relation to January 6th, but we do it all the time in any 
event. 

Q Sure. Wewere told during a briefing with the Bureau folks that until this 


SIOC was set up on the Sth of January, no one was looking at all those hashtags in its 
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totality. And it sounds like you're saying something different, so | just want to 
understand. 

[Discussion off the record. ] 

Ms. Moore. _|'m not sure who provided you the previous briefing. 

1 Ms 

Q Steve Jensen. 

A Okay. So Steve works in our headquarters component. The Washington 
Field Office area of responsibility falls under me for intelligence. | can assure you we 
were looking at the hashtags and we were putting it all together. So I'm not sure 
that -- | know Steve. Steve's an amazingly and incredibly capable young man, but for 
him to brief he may have overstepped his lane on his brief. That would not be accurate. 

Q = Socan you explain why he would have that perception from the unit that 
he's covering in the headquarters? 

A It may be his unit at headquarters, but for Washington Field Office, that's 
our responsibility. That's our bread and butter. That's what | do everyday. | cannot 
speak for what Steve testified to or why he would have said that, but | can tell you what 
the Washington Field Office was doing and that's what | am explaining. 

We -- it does not correlate to what Steve said. We were absolute -- there would 
have been no other reason for us to put that hashtag on it and to search. And so that 
was absolutely what we were doing in the days -- that's what my whole team does. 
That's our existence is to check this stuff out and to develop that picture. 

Maybe Steve -- and | should not anticipate this -- was testifying more at the 
national level or something. | can't speak to the national level, so we'd have to have, 
like, him -- 


Q Sol guess that's maybe the confusion, right, because you're only focused on 
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your area of responsibility. Aren't the hashtags -- it's our understanding that 56 field 
offices on December 27th get this directive from headquarters. 

A Correct. 

Q Anything related to January 6th -- I'm summarizing -- put this hashtag in. 
So that is uploaded to the Guardian system. So isn't that seen by your office -- 

A Correct. 

Q- --as wellas whatever you and Steve Jensen -- 

A Yeah. | think Steve may have just spoken outside the lane on that. But 
I'm telling you that's not how this was. 


Q But my question is, are you seeing everything nationally? 


A Yes. 

Q Okay. 

A lam. |can see into everybody else's pot, for lack of a better word. 

Q_ Right. 

A | go in there and the system allows me, one, to set predictive searches where 


| can say, anything with January 6th, tag it and bing me. And then with the cert unrest, 
anything that gets tagged this, put it in my mailbox. Anything that has, you know, "stop 
the steal," you know, certification violence, whatever it is, and | can search that 
throughout that entire Guardian system. And we were doing that. 

So we were not even just dependent upon the hashtag; we were searching that 
Guardian database for anything that may slip through a hashtag. So we absolutely were 
looking at that on a national level. 

Ms. Greer. But you can't speak for what headquarters -- 

Ms. Moore. Correct. 


Ms. Greer. -- DTOS, the Domestic Terrorism Operations Section, would have 
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been doing and whether they were searching -- 

Ms. Moore. Correct. Yeah, | didn't -- 

The Reporter. Excuse me. You have to go one at atime, please. 

Ms Ss So Steve Jensen oversees DTOS, right, the Domestic Terrorism 
Operations Correction? 

Ms. Greer. Section. 

Vs Operations Section. 

So if I'm hearing you correctly, his unit may have only started putting this together 
on January 5th, but you as the SAC over intelligence had been doing this, essentially what 
you're saying, on a daily basis, it's a growing threat picture? 

Ms. Moore. Around the clock, correct. 

Vs Okay. 

Ms. Moore. But, again, we were in regular communication with DTOS. So, 
again, somebody had to put out the notice to doa hashtag. We're going to get to it, so 
we're going to talk about CHS as canvassing travelers. |'m sure we'll discuss all of that 
today, right. So all of that we were coordinating through DTOS, so we were all talking as 
well. 

Ve | Okay. 

Mr. a So just to close the loop on the December 19th tweet and the D.C. 
Fusion Center, that you told us about the uptick after -- the head of the D.C. Fusion 
Center briefed his boss, who briefed the Mayor, who ultimately decided to request the 
National Guard because of that intelligence, that increase that they were seeing in the 
leadup to January 6th. 

And what | want to ask you about is, The Washington Post has reported about the 


purportedly low regard that the FBI held for fusion centers, derogatorily calling them 
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confusion centers, forexample. And that the D.C. Fusion Center in particular, given its 
proximity to lead Federal intelligence agencies, was seen this light. 

So I'm just wondering if you had any insight for us in your view, did you 
encount -- is that a view that you've encountered within the FBI of fusion centers? And 
if so, how prevalent would you characterize it? 

Ms. Moore. I'm going to seek counsel advice here ina second. But we had 
entities stationed inside our fusion centers. Soclearly we have a place of value. | 
wouldn't put a resource of mine embedded on a daily basis inside of an area that | didn't 
consider to have some value or bring value to the table or that | wanted to share 
information with. 

[Discussion off the record.] 

Ms. Moore. And so to go back to your statement early on where 
the fusion -- see, you're talking about the consortium in D.C. -- 

By ve 

Q- Right. National Threat Intelligence Consortium. 

A Consortium. They don't use the term fusion centers. | wanted to make 
sure, because we do have a fusion center in Virginia as well that we use. 

So | wasn't aware that NTIC had set up information and that the D.C. Mayor had 
requested National Guard prior to January -- that was not -- like, | didn't have that 
information, but we absolutely had resources stationed inside of NTIC. 

Q- Right. You did know about the -- in the materials, you did know about the 
Mayor's office request for the National Guard on December 31st in anticipation of 
January 6th, right? 

A | actually don't think | -- 


Q Okay. No worries. 
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A | may be confused who requested the National Guard, so! apologize. | may 
just be confusing that in my head. 

[Discussion off the record. ] 

Ms. Moore. So the Mayor of D.C. -- that's where I'm confused, that's why I'm 
slightly confused. | apologize -- 

BY MR. 

Q Sure. No worries. 

A -- is the Mayor did send a letter to the Department of Justice asking for none 
of our resources, that they had this covered. 

Q Okay. 

A So | guess that's where I'm getting confused. 

Q Okay. Noworries. Buta letter was sent to the Department of Defense 
and the National Guard requesting National Guard assistance ahead of both January 5th 
and January 6th. But that's a little bit beside the point. 

It sounds, though -- just my final question is, given the embed situation with NTIC, 
you feel pretty confident that any intelligence that you pushed out would have been 
given to them and that any intelligence they had you would have seen or would have 
come to WFO. Is that correct? 

A If they were sharing their intelligence, that's the means that we share 
intelligence through, correct. 

Q Okay. Sol want to go through some specific things, intelligence 
information. So let's start with exhibit 10. And it says there -- 


Ms. Greer. Is this a good time to take a quick break maybe? 


vie Sure. 
Ve Let's go off the record. 
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[Recess. ] 
oy ae: 

Q So we're back on the record. 

| wanted to point you toward exhibit 10, and this is IOC intelligence. Onthe 
morning of January 6th, it notes that, quote, Online actors have become active on Parler 
and TheDonald.win, enabling online actors to pose violent and threatening language. 

In particular, | wanted to point you towards TheDonald.win. When did you 
become aware of that site and the forum and what messages were being exchanged on 
there? 

A Long before January 6th. 

Q Okay. 

A So it says "a previously unknown," that's a typo. It's a previously known 
website. Oh, you probably didn't even see that. Did | just point something out to you? 
Gosh. Only the question asked. 

We knew. | can't tell you the exact date, but it was well in advance of January 
6th. So specifically on this, it's a typo. 

Q_ Andso what did you -- let's talk in particular about intelligence concerning 
the tunnel system at the Capitol complex. So that was stuff that was shared on 
TheDonald.win. Do you recall that particular piece of intelligence? 

A | do recall a particular -- | do recall a piece of intelligence about the tunnels. 

Q What did WFO, what did your branch do with that? 

A We would have shared that with our partners. | would -- | don't -- | 
remember it because we've talked about it and obviously the tunnels became very 
important. But we would have shared that with our partners. Our partners, the 


Capitol Police, were very aware of their tunnel system and the issues surrounding any of 
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that. But again, it was shared with our partners. 

Q And when you say shared, does that mean in phone calls, in which ways? 

A In multiple ways. So we talked about several times, right, we're having 
multiple meetings aweek. And | tried to get my team to count down the number in 
meetings and -- we didn't -- like, they're all happening, we're having calls or calling 
partners or reaching out, we're touching base. We try to be very careful about circular 
reporting, because on Tuesday we might have a subcommittee meeting for the NSSE, 
which is the 19th, and then on Thursday, we have our regular partner call as well. And 
then somebody will repeat something that we briefed on Tuesday on Thursday, and you 
have to be really careful because it's the exact same thing that | just briefed on Tuesday, 
they're actually just rebriefing my information and it's not corroboration of something. 

So you try to make sure we're not just circularly reporting all the exact same 
things. But we would have briefed in that capacity. We would have talked about it 
and shared it amongst our team. 

Q Outside of disseminating it, what would you have liked to have done with it 
if there was more that you could do with it? What -- so I'm asking about, again, First 
Amendment concerns. This is -- the intelligence is basically, right, an uptick in the 
viewing of sites describing those tunnels, which is obviously protected speech. You can 
go ona website as much as you like, right? And the posting of those maps, things like 
that. 

Did you have any sort of -- was there any restriction on further action you could 
have taken on intelligence like that given the world that you're in in the FBI? 

A So -- and I'd like to see that post again right now, but it is the -- or that piece 
of intelligence. That was, again, an increase inthe tunnels. So we would brief, hey, 


our social media exploitation is seeing an increased talk of the tunnels around the Capitol. 
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Are you seeing specific threats to the tunnels? No. 

So without that specificity, like, just talking about, like, hey, did you know there's a 
tunnel system under the Capitol. Hey, the tunnel is going on the east, the west, the 
north and south side. | can't action that. What|I can do is share it. 

And so that's what we would do, is we would share, hey, we are seeing an 
uptick -- since you used our word -- in postings about the tunnels, but -- and we would 
say, this is what we've seen. But without it being very specific violence towards the 
tunnels, we can't take action or do that next step where we open it as a Type 1, Type 2 
and go out and try to interview that poster. 

Q What about products? What can we do in terms of -- or what can FBI with 
WFO do in terms of creating a product surrounding a piece of intelligence like that? 

A So again, remember that's like a needle in a needle -- right -- stack, is they're 
not saying anything that's not First Amendment protected activity. So talking about the 
tunnels, there's nothing illegal about it. What | can say is we're seeing an uptick in the 
discussion of the tunnels. 

Q_ And so tell me about what types of products are there -- 

A That wouldn't be a product. 

Q Okay. So would it be -- 

A It wouldn't really rise -- 

The Reporter. One ata time, please. 

We Sorry. 

We've got to talk one at a time. 

Ms. Moore. Oh, I'msorry. l|apologize. We said we were going to do that in 
the beginning too. 


It would have to have other corroborating information or, again, raw intelligence 
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that we thought in that moment our partners might not know and we need to publish it 
as a -- and we could do that, depending upon how we received it, maybe through an IIR 
or something of that nature. But in this situation where you're just having people talk 
about tunnels, we're going to share that in our intelligence briefings with our partners, 
but it's not necessarily product. 

BY MR. oe 

Q_ For the record, can you explain to us, you know, spell out for us IIR and 
maybe SIR? And tell us what one would be, what would qualify to put it on an IIR or an 
SIR? 

A It's an intelligence information report; that's raw, uncorroborated 
intelligence that might serve to inform, but it has a lot of caveats withit. | think you 
have some examples of them. They're heavily caveated that that has not been vetted 
out. 

Q Okay. 

A _ Andso, again, talking about the tunnel system in a generic isn't really IIR. 
People talk about the tunnel system in D.C. all the time. 

Q What about a situational information report? 

A So those are disseminable to local law enforcement as well. 

Q Okay. What are the differences between an intelligence information report 
and a situational information report? 

A A situational information report may still also -- may -- also be raw 
intelligence, but it's raw intelligence that we want to get in a more professionalized 
product to partners -- 

Q Okay. 


A -- through different dissemination. 
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Q__DolIRs get disseminated as well to your law enforcement partners or no? 
A They don't. 

Q_ Got it. 

A Usually. 

Q Correct. 

A But remember, IIRs can be disseminated through our Joint Terrorism Task 


Force with individuals that have clearance or might have the need to know or that access. 
So it's not that they're never seen by a partner; it's just we don't publicly disseminate IIRs 
because, again, they're raw intelligence, super raw. 

Q Is it accurate that the only SIR surrounding the events of January 6th that 
was put out was the Norfolk, Virginia, January 5th SIR? Is that accurate, as far as you 
know? 

A | thought there was asecond. | thought one of your exhibits had a second 
one, 

[Discussion off the record.] 


Ms. Moore. Oh, | do believe that is correct. 


By ve 


Q Okay. And so your branch in particular did not put out an SIR -- 

A No. 

Q_ -- dealing with January 6th? 

A We did not. 

Q  Whynot? 

A At that time, we did not have specific actual intelligence that we felt needed 


that to be disseminated in that manner. So you can disseminate information in different 


manners. AnSIRis one way. So that was published by our Norfolk Field Office. They 
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wanted to share it out, and that was the avenue that they chose to share it. When you 
are doing that, we have to be very careful about not disseminating something that's just 
strictly First Amendment protected speech. And so, again, as we talk about the tunnels, 
that was First Amendment speech that weren't specific threats or actionable intelligence 
off of that. 

vs 

Q Can | just follow up on that, on the threat? 

So | understand you're saying that people talk about all the tunnels all the time. 
But in that context -- and we can probably bring up this particular tunnel posting -- there 
was some level of specificity to it in the sense of it was related to a specific date, right, 
January 6th. It was also related to the volume, the uptick of hits on the tunnel, right, 
related to the bigger picture of what was going on in the days preceding January 6th. 

So it's -- | want you to reconcile how it's tunnels -- being talked about tunnels 
without this backdrop. | can understand what you're saying that it's not specific and 
actionable. But how do you take what you see about the tunnels in the context of 
everything else that's going on? 

A So let's find that. Can we look at it? 


Q Wecan--yes. I'm sure|l can find it. 


A It helps me talk through it. I've got a lot of stuff in my head. Sorry. 

Q Sure. 

A As general when they were looking for that, | don't know who has it or 
where it is. 


But again, First Amendment protected speech is just that. ee 
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A We would review this in the context of things. For me personally, as the 


special agent in charge of the Washington Field Office, right, we start talking about 
tunnels, and I'm like, | thought we -- make sure everybody knows this. Jen, the Capitol's 
already got this exact same information that we have. Our partners have the same 


information. We're going to -- we'll call it, we'll talk about it on a partner call right now. 
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We get on a partner call, and the partners are like, yep, everybody's aware there's 
an uptick around the tunnels. The Capitol Police is on the partner call. They're not 
expecting any additional concerns, other than saying they're seeing this to. They've got 


it. And that's what | can do. 


Q Okay. | think we're going to go through more, but it'll be the same 


question at the end, so -- 
BY MR. 

Q Can you maybe explain to us the benefits of an SIR over just pushing it out, 
information only, you know, calls, so on and so forth? WhatdoesanSIRdo? Does it 
call more attention to it? Does it lend it more credibility? How is it that -- 

A Uh-huh. _ It can -- again, it just opens up. It's just the Bureau's way of 
externally sharing with local partners that may not have a clearance. 

Q_ Allright. So let's say that there was more specific -- in your 
mind -- specificity in that piece of intelligence. In your mind, you would not see 
necessarily a benefit in an SIR being produced for it or that it would have either reached 
more people or have been more effective. You see it as -- 

A So, again, the SIR is going to go -- it can be that sometimes we would 


disseminate it within our local partners, right? But I'm already talking about this on 
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active phone calls with my partners, all the same people that would get an SIR. It would 
be the exact same people that would see an SIR. An SIR doesn't publish overnight. So 
it's much quicker at this point for me to share this information. 

As you saw in our SITREPs, you saw how we were pushing it out. It's quicker that 
way. And so that was our choice of dissemination. 

Q_ Andsothen it seems to me that you would agree that there is no added 
benefit to -- 

A For us in that moment, no, sir. 

Q Let's talk about the one SIR that was put out by Norfolk. _ It's right that 
there was a QRF sort of contingency outside of Virginia. Your office did not put that out 
as an SIR, right? The Norfolk office put it out as one? 

A Yes, that's correct. 

There was two in Norfolk. 

Ms. Greer. There were. 

Ms. Moore. | don't -- | wouldn't have it. 

ue It's just the SIR, not the IIR. But it was, you know, it had been 
widely reported late into January 5th, it's the only one that was put out. 

[Discussion off the record. ] 

BY MR. oo 

Q You mentioned that, you know, that's the way that they decided to put it 
out. | guess I'm wondering is it -- you know, is it because that's, you know, in Virginia 
that that's sort of their -- it's in their bailiwick how to put it out, or could that have been 
something that your office could have put out as an SIR? And if so, why didn't you? 

A Again, we were -- so Norfolk is not in our area of responsibility. So for 


them to share something with our area of responsibility, they have several different ways 
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of doing that, right? They chose in this instance to produce an SIR because they felt that 
it would facilitate getting the information out to our partners or that it will allow us, 
should Dallas -- Dallas -- should Washington Field Office choose to push it to our partners, 
we candothat. And so they pushed it to us. 

We, in turn, turned around and briefed it to all of our partners and shared it with 
our 53 people on our joint task force to where -- we have a dissemination mechanism and 
we disseminated it to allof them. And we briefed it at both our command posts. 

Q_ This is after it was pushed out or before? 

A Simultaneously. | may not have understand your question. I'm sorry. 


Q = So then when you did that, it would have been January 5th, because that's -- 


A Yes. 
Q Okay. 
A It came in to us and we turned around immediately within, | think, an hour -- 


Okay. 


> Pp 


-- and briefed it to all of our partners and pushed it out amongst our 
dissemination portal onthe JTTF. So the 53 partners would have gotten it from us. 
But it's the exact same way that we push out a SITREP. 

So our SITREP, you know, gets briefed in the command post to all of our partners 
and is shared through our dissemination portal, so -- or our dissemination emails. So 
the same people, it's just a different means. And maybe they chose an SIR -- | can't 
speak to why they chose an SIR. 

Q But when, if at all, did you become aware of talk of occupying Federal 
buildings in the leadup to January 6th, if at all, if you recall seeing intelligence about that? 

A | don't recall seeing intelligence leading up to January 6th specifically talking 


about occupying Federal buildings. 
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Q Okay. What about storming the Capitol? Again, earlier you had said you 
hadn't seen any actionable intelligence regarding storming the Capitol. Do you recall 
seeing talk about storming the Capitol or any sort of intelligence -- 

A Rhetoric. There was some rhetoric out there that we should, you know, 
storm the Capitol, but it wasn't like, let's go storm the Capitol, we are going to storm the 
Capitol. It's, you know, we should take over the White House, we should -- there were a 
lot -- there was so much rhetoric out there. So was there some rhetoric to that? Yes. 
Were we sharing that? Yes. 

Q__| was going to ask, what did you do with it and -- 

A We would share. 

Q Okay. And | think | know your answer, why didn't it lend itself to a product 
being created? 

A It has to not just be First Amendment speech. _ It has to be actionable in 
something that I'm not just taking people's First Amendment rhetoric and recaptioning it 
into a product. And atmospherically, we were briefing that every day with our partners. 
We were talking constantly with them. 

And simultaneously, the FBI was not the only individuals searching social media. 
Our partners have social media exploitation teams as well. So we're all -- again, like | 
talked about, reporting is the things that our teams are seeing within social media, the 
things that our teams are getting from CHSs, anything that we have on a case may be. 
But everyone is still sharing what they're seeing. So we're not the only ones seeing the 
rhetoric. 

Q Okay. 


By MR 


Q_I'msorry. This goes back to what we were talking about before. | guess 
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I'm confused now. 

| thought you said, Ms. Moore, that the First Amendment applies to what the 
Bureau can do sort of in an actionable way, but it doesn't apply in any way to what you 
disseminate. In other words, you get stuff all the time and there is no First Amendment 
filter legally on the Bureau's ability to disseminate that. Am | incorrect in that 
assumption? 

A We can't just collect for the sake of collecting. And so what we're 
collecting, again, is under that Type 3 authority. And it has to be something in addition 
to a First Amendment right that ties to an act of violence against that First Amendment, 
like protected activity. So if there's going to be a march, we don't just generally, you 
know, say, hey, there's a march on Thursday and we're going to collect everything we 
can. We're looking specifically for violence targeting that. 

And so we're talking about the rhetoric that we're seeing with our partners. 
We're putting it in SITREP just, again, to say, hey, this is what we're continuously seeing, 
this is what we still have out there. 

Q Yeah. I'm just trying to understand the difference between collection and 
dissemination. | get that you can't collect stuff from certain sources if it's First 
Amendment protected activity. Once it comes in the door, though, from any source, | 
don't believe, or correct me, there is no further First Amendment review. You can 
disseminate anything once its in your system from any source -- 

A But! -- 

Q_ --if it seems relevant to an ongoing discussion of an event? 

A Okay. Any information that we get in, we have to be, especially if it's from 
a third party, what is their motivation for sharing it with us. We're going to look at all 


those key aspects. But! also don't want to just throw everything | get out randomly 
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because, again, everybody's already searching in this big needle stack and you don't want 


to create extra noise to what everyone's searching. So you want it to have some 


viability -- 
Q Sure. 
A -- or claim to a bigger picture, thus the sharing of the tunnel information, 


that type of thing. 

Q That's a totally different calculus than whether it violates the First 
Amendment. Of course, professional law enforcement organizations shift and evaluate 
the credibility of information and decide which of that information meets the standard of 
relevance and is -- that's not a First Amendment issue. That's a practical assessment of 
the potential value of the information. 

My question is precisely, does the First Amendment, the restriction -- legal 
restrictions of the First Amendment affect your calculus about disseminating information 
once it comes into your systems? 

[Discussion off the record.] 


Ms. Moore. So l'm not the attorney representing the Bureau in this matter. 


BY MR. oe 


Q  lunderstand. 

A Andso-- 

Q I'm looking for your practical assessment of that. 

A But what legally is all of that is still assessed, is still assessed by our 


attorneys. | would have to defer that to a legal person to help us discuss what we would 
disseminate and what we wouldn't. But again, practicality, we're going to assess 
everything that comes in before we push it out. 


Q__ So legal's involved in reviewing dissemination decisions, not just 
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collection decisions? 

A Absolutely. 

Q And again, maybe you don't know the answer to this, but not just relevance, 
credibility, but First Amendment concerns impact that dissemination decision? 

A Absolutely. 

Q Okay. 

But again, | would need -- you would want to lead the person. 

Q Understood. 

BY MR. 

Q  Sowe were talking a little bit about specific pieces of intelligence and what 
todo about them. So let's -- | think at this point I'm going to go through the Guardians 
in a moment, but | kind of want to zoom out to written threat assessments. 

So have you been made aware, as you sit here today, of the Capitol Police threat 
assessments by its intelligence division and the sort of famous paragraph where it 
mentions that, unlike the previous two MAGA marches of November and December, that 
the target was going to be Congress itself, not the counterprotesters? Are you, as you 
sit here today, familiar with that product? 

A As | sit here today, I'm familiar with that product. 

Q  Solcan assume your answer, it sounds like -- is it fair to say you had not 
seen it prior to January 6th? 

A | had not seen that product prior to January 6th. 

Q Okay. 

A My team had not seen that product prior to January 6th. 

Q Was that assessment, that particular line about the violence not being as a 


result of the skirmishes between protesters and the counterprotesters but targeting 
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Congress itself, is that consistent with what your branch was seeing or believed to be the 
threat picture leading into January 6th or not? 

A No. 

Q Okay. And I'm going to ask you what your sort of your top-line threat 
assessment would be, but maybe | should ask it this way. | know what theirs is, because 
they wrote it down. Wouldn't it have been helpful for the FBI headquarters or office, 
whomever, to have put out some sort of written threat assessment, some sort of either 
maybe a joint bulletin with other partners in the intelligence community, something that 
sort of all the review that your analysts were doing in terms of this tag, right, that could 
synthesize all that information and put out a threat picture for all of your partners, 
wouldn't that have been helpful prior to January 6th? 

A We were doing that multiple times a week in briefs with all of our partners. 

Q But what about a written product, wouldn't that have been helpful? _ It's 
written, you can go back to it, you can see it. It would have your sort of top line, you 
know, threat assessment as to what to expect on January 6th. Wouldn't that have been 
helpful? 

A | think it was a choice we made at the time was that we valued our personal 
briefs. And we were doing that, again, multiple times a week, daily, on phone calls, on 
conference calls, in person, on SVTC talking about what everyone was seeing. 

Q What -- 

A Hindsight, sure. But at that moment, we're trying to push information out 
as absolutely fast and as quick as | can and as accurately as possible and with the widest 
dissemination possible. So we were writing SITREPs in advance of January 5th. We 
were heading SVTCs and those things were being shared between our task force officers 


and our management. 
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Q_ And this exercise is one in looking in hindsight, right, because our -- 

A Sure, absolutely. 

Q__ -- objective is to try to keep it from happening again. And so there -- 

A That is right. 

Q_ There certainly are explanations and justifications for the actions that were 


taken. Butlam asking also, in hindsight, what would have been better, what would 
have been -- you know, so we can make improvements in the future. 

So do you think, ultimately, is it fair to say that you would agree that maybe a 
written product, a written threat assessment might have been on the margins, except 
even if marginally better, might have been beneficial -- a beneficial way of getting out a 
threat picture to your partners? 

A | think it's definitely something that we have assessed, as we've talked 
about, right? The FBI wants to bat 1,000 every time we get up to the plate. And we 
never, ever, ever want to have a miss. Our partners don't ever, ever want to have a 
miss. And we want to collaborate and be the best at sharing information that we 
possibly can be. 

So there are takeaways that we are going to take from January 6th. We 
learned -- | think you all already know this, right? Like, we depended heavily on our task 
force officers and our dissemination through our task force officers to feed information 
up through their chains. As different testimonies indicated, people at the highest level, 
it may have gotten briefed all the way to the assistant chief, but that assistant chief 
decided that the chief, it really wasn't relevant to him. Andso now -- so now then we 
brief bottom up and top down. 

So what we thought was happening we learned probably wasn't happening as well 


as it should. So now we're going to take it from both angles that we could. But would 
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have writing a threat assessment now, in hindsight, it could not have hurt. 

Q- And |think | can tell also from maybe your reaction to the not having seen 
the January 3rd assessment by Capitol Police, would it have been helpful to you to have 
seen that prior to January 6th? 

A | would love to have seen a product from my colleagues, sure. 

Q And what do you think -- what would you have done if you had received a 
threat assessment that said that -- that had in stark terms, you know, the target was 
Congress itself, that's where at least this analyst, the head of that intelligence division, 
and Capitol Police had come to that assessment, what could you have done with having 
known that prior to January 6th? 

A So, again, we're now in the land of speculation, right, of what | would have 
done looking backwards. How do you see that? We would have analyzed it. We 
would have taken it and compared it to the threat picture that we were seeing. And 
then we would have discussed it with all of our partners to see if anybody else was also 
seeing this or where this product was providing different information than everybody had 
in one, and what was their validity to that. 

Q Andon this question, | just have a process question, if you could go to 
exhibit 10. 

Ms. Moore. Excuse me. 


vi ae Okay. 


[Discussion off the record. ] 
BY MR 
Q Okay. I'm going to ask you about how -- what the Capitol Police 
intelligence assessment, how that was either consistent or inconsistent -- | believe you 


said inconsistent -- with what the threat picture was within your branch leading up to 
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January 6th. 

First, | want to ask you, on exhibit 10, it says there, quote, The information 
contained in this communication is not to be incorporated into any formal or informal 
written document without the authorization of a special agent in charge, Washington 
Field Office. 

So | just wanted to make clear, if this is true, it would have been -- it could have 


been your call whether to put out a written threat assessment, is that right, at your level? 
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[12:15 p.m.] 

Ms. Moore. Sure. But! want to emphasize something, that had we gotten that 
document that Capitol Police has published now, for the FBI, we still wouldn't have, 
ourselves, sent resources to the Capitol to protect it. Does that make sense? 

Q_ Yeah. 

A Okay. 

Q You said that that was not the top-line sort of threat picture heading to 
January 6th that was on your mind and the mind of your branch. So what was? What 
was the top-line -- 

A We were -- 

Q  -- assessment? 

A We were looking at the rhetoric and what we were seeing, and it was still 
largely group against group. So it was, you know, different groups pontificating hate 
rhetoric to other groups. 

Q___ Did you notice any uptick in threats to Members of Congress or intelligence 
talking about the roots of Democratic Congress Members for January 6th, how they got to 
the -- to their offices, any of that? 

A We had some threats to Members of Congress, and we shared that with 
Capitol Police. Those were sent over. | think we had, perhaps at one point, | think we 
even mention in one of our SITREPs, like 10 Guardians that went over to Capitol Police 
specifically related. As far as the root portion, I'm not -- | can't speak to that. I'm 
sorry. 

Q Okay. What does account for the fact that your threat assessment, as 


you've articulated here today, is not in line with the one put out by Capitol Police on 
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January 3rd, given that you were all seeing the same things? How was it that 
they -- how can you reconcile for that -- us -- reconcile that for us? 

A Solcan't. |can tell you that we were meeting with our partners, again, 
multiple times a week, daily towards the end, sometimes hourly if something came in. 
Not once was that part of the brief that they provided to us. 

Q Okay. Go ahead. 

oy 

Ql appreciate the meetings, but | think that the investigation that we've 
conducted shows that essentially every agency had the same data available to them, 
including the Capitol Police. And when they -- when the analysts wrote that assessment 
that Congress itself is a target, which you say would've been helpful at the time, 
what -- what is the difference in the analysis of what your -- the folks that you're 
overseeing did that wasn't able to piece it all together on January 3rd as the Capitol Police 
did? 

A | would need to know what -- what specifically Capitol Police was utilizing to 
write that product. 

Q_ That's fair. If | -- if in response to that, if | tell you that they had essentially 
the same information as the Bureau did and, in fact, likely less because of the information 
they were receiving from thousands of pages of document production that we have from 
the Capitol Police, a lot of it is from analysts from the Bureau giving it -- pushing it out to 
the Capitol Police. 

So taking that aside, | guess, it's all level field if you all have the same information. 
Can you just react to what led to a product here and not a product within the Bureau? 


Ms. Greer. Can we take a quick break? 


Ms sure. 


24 


25 


75 


. We can go off the record. 


[Discussion off the record. ] 
Vs Sorry. | know Tim has a question, but | wanted you to answer. 


Vi Answer, yeah. Go ahead. 


Ms. Moore. Do you want to give me the question again? 

Q_ The question was, essentially, why did Capitol Police, why were they ina 
position to issue some sort of written product and the Bureau didn't? 

A | think that wherever you sit is where your focus is going to be, right, to 
some extent. So Capitol Police's intelligence components is going to be really focused 
on the Capitol. We are charged -- | was focused on the protection of Federal buildings 
as well, right, is Hoover going to be safe, is headquarters for DOJ going to be safe, are 
those type of things -- we're looking at the city as a whole as well and providing that 
threat picture out. It was a decision we made. 

So what it -- regardless, if I'd have had that document in advance, | would've loved 
to have it for a healthy conversation on what they felt was different than what we were 
allseeing. Unfortunately, that wasn't the case. | hope that Capitol Police would have 
used that to make the decisions as to how -- what they were going to do at the Capitol 
that day. That would've been ideal. 

For us, even with that information, it wouldn't have changed what we were doing 
again. Soin our leadup to January 6th and what -- the way we postured ourselves with 
doing our social media exploitation, doing our Guardian checks, running our Type 3, 
hitting our CHS's, going across the country trying to figure out, you know, what are our 
subjects seeing, are we hearing anything movement wise for them, prepositioning our 


SWAT teams, offering our resources in a reactionary force to our partners, all of that 
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would've remained the same. And our threat picture also -- again, remember, 
throughout that day, we had, you know, two pipe bombs, we had the event on the 
Ellipse. We were looking at a lot of things. 

Q So just on one point, and | want to let ask some questions, but your top 
line would've been different from the Capitol Police, right? If there was -- if someone 
said you have to write a threat assessment going into January 6th, what would that top 
line have been? Would there have been a focus on counter protesters? 

A We would have built an intelligence product based off of what we were 
seeing at that time, and at that time, it would've been the uptick in rhetoric. We 
published the products on our domestic violent extremism, we published a product on 
the increase in violence towards law enforcement, so all of that would've been 
encapsulated in a product that we -- were produced into one if we were going to. So! 
can't tell you exactly what the top line would've been because it would've been long, but 
the product would've included all of that. 

BY MR. [i 

Q But it would have also included that the violence -- that would've been 
expected would've been similar to the first two marches, MAGA |, MAGA Il as skirmishes 
between the protesters and counter protesters? | do believe you said that. 

A Because that was what we were seeing. 

Q And my last question on that is just, you would agree with me though that 
the Capitol Police threat picture, the -- what | -- top line that I've read to you, that that 
was accurate, it was predictive; and that yours, what you've just stated right now, 
would've not been, is not -- was not predictive of what actually happened on January 6th. 
Is that fair? 


[Discussion off the record. | 
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Ms. Moore. | mean, sorry, if you're asking me was my -- if | had produced this 
threat product prior to it, would it have said that | anticipated people were going to storm 
the Capitol? No. But it was -- would've been informative of the entire threat picture 
that we were seeing in the national capital region at that time from the intelligence that 
we had gathered. 

By we. 

Q_ Allright. So my question is, do you agree that it was -- the idea -- violence 
was not a result of skirmishes between protesters and counter protesters like MAGA | and 
MAGA II, but that Congress itself was a target, that that -- that, what I've just summed up 
as being the threat assessment from Capitol Police, that that was accurate, that was 
predictive of what actually happened on January 6th, right? 

A Well, Congress was obviously -- there was a storming of the Capitol, so that's 
what their threat assessment says, so yes. 

Q Perfect. I'm just asking for a yes or no. And then the idea of the -- that 
January 6th would be in line with the violence, skirmishes between protesters and 
counter protesters like in previous marches, that that is not predictive of what happened 
on January 6th, correct? 

A Correct. 

Q Okay. | want to ask about the sort of protesters and counter protesters. 

I'll point you, if | can, to exhibit 5. It says here in -- it's a briefing from MPD, but 
obviously seen -- it's notes from that briefing, January 4, 2021, is the email. And it says, 
quote, "antifa is reporting on social media that they will not let their city be taken by 
Trump supporters and conservatives; however, no plans have been identified," end 
quote. 


And then | also want to point you to exhibit 6. One of the Guardians at the end, 
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number six, it says, MPD reported text tip from a Parler user, quote, Bring food and guns. 
If they don't listen to our words, they can feel our lead. Comearmed. BLM, antifa is. 
Cops are," end quote. 

A Wait, this is exhibit 6 or -- exhibit 6, which number? 

Q Number 6 of the eleven WFO Guardians by this point on January 5th. Does 
your copy not have that? 

A No, it doesn't. Yeah, no. 

Q Okay. Apologies. It may bea printing error. Oh, yours has it? 

A She's got just the stuff that you all had sent over. 

Q- Oh, perfect. It might be a little bit -- 


Vs She has it. Do you have it, Ms. Moore? 


Ms. Moore. Yeah. She's got it for me. 

vr 

Q It's just the last, "come armed. BLM, antifa is, cops are." 

A Okay. 

Q Just -- so react to this statement. Tell me if you agree or disagree. Was 
the idea that there was going to be violence between protesters and counter protesters, 
was that from intelligence that you were seeing on the antifa, Black Lives Matter end? 

So was there -- they were talking about -- you have it here, no specific plans, right? 

Antifa has no specific plans. Or was it that that sort of violence was being predicted but 
based on what's, for lack of a better term, the other side was saying, right? It says come 
armed, BLM, antifa is. 

| guess my question is, is there support for the idea that there was going to be 
skirmishes, and independent of what happened in MAGA | and MAGA II, that there were 


going to be skirmishes between protesters and counter protesters; or were you just 
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listening, overly representing what opposers, opposition to BLM and antifa were saying in 
order to rile up people to come to the Capitol and be ready for violence? Was there 
independent basis for the idea that antifa and Black Lives Matter were going to be getting 
into skirmishes with the crowd on January 6th? 

A So at MAGA | and MAGA II, we had violence and protester on protester, so 
that, again, informs our threat picture. So we would use that along with the social 
media posts, CHS reporting, anything of that nature that we have to inform our threat 
picture. 

Q  Dovyou recall any social media of the kind that I'm talking about, again, from 
purported BLMers or antifa people saying the same sort of violent rhetoric that you're 
hearing from folks on the right? Because | get you're saying, okay, MAGA |, MAGA Il, 
that feeds into it, all right. But putting that aside, was there anything else? 

A Okay. So if we look back to the one on January 4th, where we talk about 
the antifa posting, antifa is reporting on social media that they will not let their city be 
taken by Trump supporters and conservatives. So then we go on to say, Hey, like, 
however, as we're looking through this, again, this is still rhetoric, we're not seeing 
specific plans. That's the same thing that we are saying even elsewhere where we're 
saying, Hey, this is the rhetoric that we're hearing, but we don't have specific actionable 
information that we can use. 

So | think we're seeing it on both sides, and we're reporting it as we see it and 
hear it. And we're saying, again, like, Hey, there's no positive identified plans for how 
they're going to not let their city be taken or, Hey, this is where we see this. We're 
giving it to you, we're telling you where we see it, we're helping just like, Hey, this is what 
we're seeing. 


Q  Dovyou recall the mayor putting out a directive in the days leading up to 
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January 6th telling people in the city to stay in their homes and -- 

A | do. 

Q  --not come out? 

Okay. How did that affect -- how would that affect your threat -- bottom-line 
threat picture about protesters and counter protesters engaging in skirmishes, if at all? 

A | don't necessarily -- | think that that is the Mayor, and we looked at it as the 
Mayor saying, Hey, citizens, we don't know what's happening in this AOR. Weare 
anticipating a large crowd. We're anticipating possibly violence. Everybody that lives 
in Washington, D.C. is not either a MAGA I, MAGA II-type supporter, or antifa-type 
supporter. They're just regular citizens going about their day, and they're saying, like, 
Hey, stay home, stay out of the fray, because, again, this was the rhetoric that was widely 
out there. 

Q Let's go through, if we can, the Guardians. So in exhibit 2 -- | hope you 
have all of these, and if not, hopefully counsel can share it with you. 

A Exhibit 2? 

Q Yes. And here we have 16 Guardians, right, as of 08:00 on January 3rd of 
2020. 

A Okay. Sol havea little Guardian summary statement, if y'all would like me 
to read that for you. 

Q Sure. 

A Why not? 

Q That works. 

A Okay. It says: 

"| know you have a number of questions about the Guardians outlined in this 


email, and I'm happy to provide what information|! can. As | mentioned in my opening 
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statement, in advance of January 6th, the Washington Field Office was assessing what 
intelligence we had as well as what intelligence other field offices and our Federal, State, 
and local partners had that related to our area of responsibility. 

One of the ways that we did this was by looking at the Guardian database and 
compiling a snapshot in time of what, in our view, the current threat picture looked like. 
This is exactly what this email shows. 

Specifically, in addition to the summaries of the information we received from our 
partners, this email shows a wrap-up of 16 Guardians that the Washington Field Office 
was tracking at this point in time on January the 3rd. This does not mean, however, that 
all of these Guardians were assigned to Washington Field Office, nor does it mean that 
these Guardians warranted further investigative activity. 

Generally, when we receive information like that reflected in these 16 Guardians, 
the FBI's available investigative tools may include, for example, conducting public media, 
social media searches and conducting database searches within the FBI's own holdings; 
one, to determine whether there is a potential violation of Federal law and/or if they 
are -- number two, to identify the poster or potential subject. 

If based on the information we have we're unable to identify the subject or if the 
activity is protected First Amendment activity, or lacks sufficient specificity, as was the 
case for many of the Guardians on this list, then a Guardian would be closed for 
information only. Just because a Guardian is closed, however, does not mean that we 
don't share the information with our partners. Indeed, this entire summary was shared 
with our partners. 

Further, this information is factored into the larger, overall threat picture and 
informs how we are postured for an event like January 6th. Of these 16 Guardians, 


eight were assigned to the Washington Field Office, and the other half were assigned to 
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the other field offices across the country. 


The remaining 14 Guardians were closed. Guardian number one and Guardian 


number three were transferred by the Washington Field Office to the field office in the 


location in which further investigative activity could've been conducted. They were 


both subsequently closed. 


was required. 


For both, the subject was interviewed and no further action 


For number 4 and number 13 were converted to Guardian incidents and 


subsequently closed for information only on January 4. 


Number 4 was passed to Washington Field Office partners. 


Following review, number 13 was determined to not include a threat of violence 


but passed to partners for awareness. 


Guardians number 6, number 11, and number 12, the subject poster, was not 


identified. 


Guardian 7, Guardian 8, and Guardian 16 were closed because there were no 


threats made by the users identified. 


Number 9 was passed to partners. 


Number 10 database checks were performed and was determined not to be a 


threat. 


Number 15, following a subject interview, it was closed on January the 22nd. 


And number 14 was converted to a full-field investigation and has subsequently 


been closed." 


Q 


Okay. 
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Ms. Do you have an extra copy of that? That would be helpful. 


Ms. Antell. I'm not sure that this is something that we're prepared to 
hand -- but, Megan, | defer to you. 

Ms lust as we go through it. 

Ms. Greer. She read it. 

Ms. Antell. Okay. 

Ms. Greer. | mean, she's got it. 

Ms. Antell. That's fine. 

Ye It's already on the record, so it's just a matter of us keeping track 
since it's somewhat new to us. 

BY MR 

Q While we're looking, what does it mean to track? So it says, WFO is 
tracking these 16. What does that mean? 

A __ That means we're working them at this moment, in this picture in time, that 
was what was hot on the plate for Guardians. 

Q And when you mean working, does that mean -- have these elevated toa 
point where you can take certain action? Is that -- 

A Again, working. The Guardian database is where all those tips come 
through and we start sorting them. So these are things that we need to take a little 
closer look at, so that's what | mean. Sol can't tell you -- again, that's where we go 
through some of them are closed for information only, some of them got opened asa 
Type 2, some of them would lead to an investigation. 

Q So exhibit Number 7 mentions that there are -- there were 43, is the full 
universe of Guardians, is that right, tagged to the January 6th event as of January 5, 


2021? 
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A So now we're on January 5th, different day, correct. The Guardian is an 
evolution. Itis--it'sa live animal. Like right now, more Guardians are being put in the 
system. We will close some, some will open, so numbers change. 

Q _ But is it fair to say that those -- are those 43 total universe or those are not 
ones that WFO is tracking, is that correct? Or was at the time tracking, | meant, not 
now. 

A Well, we were tracking them all. 

Q Okay. All right. 

A So, | mean, again, there -- we tagged them and so that's what | was saying, 
like we put that tag, super handy, | can go in there and run through and be like, 
where -- where do we stand? What are we doing? And what's the status of each of 
these? 

BY VS. as 

Q So just so I'm clear, so once the directive comes out December 27th, 56 field 
offices, as of January 5th, there's 43 Guardians in total from across all of those 56 field 
offices? 

A Correct. 

By Re 

Q Okay. Andon January 3rd -- 

Ms. Greer. One second. 

[Discussion off the record. ] 

Ms. Moore. As of that moment, at that time, that's how many Guardians we 
had. So we may have already closed some, right. So it may not be fully reflective of 
everything we'd seen up to that moment on January 5th. ‘This is just what's live at that 


moment. 
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or 


Q_ Right. So-- 

A And it may not all be within our area of responsibility. Again, we kind of 
talked about that a little bit, too. So maybe it is a poster that lives in Wichita, Kansas, 
that we're able to -- that we're going to send that to Wichita if it's not specifically 
something that we can work in our area. 


Q__ So, then, there's a difference between the nationwide number of 


Guardians -- 
A Correct. 
Q_ -- associated with that hashtag versus what you're seeing at WFO? 


A We're still seeing them. 

Q Okay. So what does the 43 reflect, the nationwide or your AOR? 

A Nationwide. 

Q Okay. Soasa layperson, | want -- can you explain, if you -- you -- we've 
seen all of these kind of tips and social media sites and the information that's provided to 
you yO just what we've seen alone in the document productions, | would 
say, exceed the number 43 and we're not looking at it nationwide. So asa layperson, 
that number seems low. 

A So this kind of goes back to that tricky wording that | talked about at the 
very, very beginning. So the Guardian is a system, and then type assessments are also 
referred to as Guardians, so those that have a higher level that we can review. And then 
we have the pre-assessments, which can also sometimes be called Guardian. So in this 
count, we are counting our tagged events, so the ones that specifically have been tagged 
that we find of relevance and importance in that moment. 


Q Okay. So what about if someone just calls up like Lincoln, Nebraska, on 
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January 2nd and says, | have a cousin who's planning to storm the Capitol. Does that 
get -- 

A Well, that would be a Type 1, because we've got specificity and a caller. 

Q So does that -- is -- would that have been tagged with the same hashtag? 

Should have been. 

Q Okay. 

[Discussion off the record. ] 

Ms. Moore. So, again, just to -- just to clarify, is what she's asking me to do 
there. Different what you said versus somebody calling and saying, my uncle is coming 
to protest in D.C., see what I'm saying? So like you're saying, My cousin is going to go 
storm the Capitol. |'m going to run that a little bit more down, because why do you 
think your -- I'm going to call you back, why do you think your cousin is going to storm the 
Capitol? Whois your cousin?  |'m going to do database searches on your cousin. |'m 
going to see if I've got social media searches on your cousin. _|'m going to see if you can 
tell me anybody else that can verify what your cousin can do. I'm going to try as quick 
as | can to get that to a Type 1 or Type 2 assessment, and then I'm going to go and try to 
have a disruption plan to go talk to your cousin, right. Like why do you want to do that? 
Now I'm going to try to elicit from your cousin information. 

Q So my question -- 

A It's different than just telling me somebody is coming to D.C. 

Q  Gotit. But just in terms of the narrow assessment of how it's uploaded, is 
there a difference between -- in the 43 Guardians that we -- that were counted, is that 
type -- is ita Type 1 and a Type 2, or is it only a Type 2? 


A Okay. Sol haven't done avery goodjob. So there's pre -- I'm so sorry. 
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Like | need like butcher block and some pens here. So it's pre-assessment. Type 1, 
Type 2, | don't know why we do this, it's the same thing. So Type 1 and Type 2 are just 
lumped together, so it's not like a Type 2 anda Type 1. So pre-assessment is this -- that 
generic pool. Type 1 and Type 2 are when we open it and we're peeling back the onion 
more. 


ye 


And for it to be a Guardian -- 


p 


> 


They're all Guardians because they're all in the database. 

Q- Andthey're all being tagged, even the pre-assessment? 

A That -- if it's a pre-assessment, yes, that was if it had specific information 
related to that. Here | think we're reporting -- and | wouldn't -- | would really want to go 
back to double-check this, but this should've been what we were really looking at, 
because we had hundreds of stuff in there, but this was the stuff that we felt that really 
was focusing potentially on something actionable. 

Q Okay. So for the record, you do not think 43 is the total number of tips in 
the system tagged under that -- under "cert unrest." It would've been, just those 43 are 
basically what you're tracking? 

[Discussion off the record. ] 

Ms. Moore. Let me try to explain this again, because I'm not doing -- like we're 
both -- if it's coming in from like the general public, right, it's going to go through NTOS. 
NTOS is going to do the initial threat and triage on it, and then they're going to send it 
out. Weare still looking through that. 

So what I'm saying is, there are currently 43 Guardians, those are the 43 
Guardians that we are tagging and truly looking at that have potentially something that 


we can do something to. We were -- there was definitely more information received 
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than 43 tips. 
By ve 
Q Okay. So it could be true that Mary -- something [iin sent in 


wouldn't be part of those 43, still uploaded, as you told me, everything gets uploaded, 
but isn't tagged because it hasn't been risen to the level of -- 

A It may not have been tagged. But remember, | also have an analytical 
team, because we recognize this vulnerability, who are doing keyword searches of the 
system itself. So they are doing that freelance just search, search, search of the system, 
different than tagging, because tagging makes it easy for us. That's our dream. 

They're going in and checking for anything else. 
5Y Ms 

Q But isn't it tagged before it gets to you? 

A Not necessarily. You would hope. 

Q Isn't that the purpose of the December 27th directive though, to have those 
offices tag it with the relevant -- with the -- with the tags so someone like you can assess 
it? 

A They're tagging it -- but everybody is assessing it as it comes in, so NTOS is 
going to -- so NTOS may get acomplaintin. As they are putting in the complaint they're 
running their initials on it and it is just rhetoric. It's not something that's actionable. 

It's going to go in, but it may not be tagged to "cert unrest." The action -- more 
actionable pieces are going to be tagged, and but our team is still searching that entire 
database in case somebody didn't hit a tag right, or we see like a cumulative match-up of 
information. 

Q But it sounds like what you're saying is that there is a discretion in terms of 


tagging. So our impression was any tip threat coming in related to January 6th got this 
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tag and it's uploaded. But it sounds like, from what you're saying is, there was a step 
before that, so not all the information got the same "cert unrest" tag. Can you just 
clarify that, because those are two very different things, right? 

A It's hard to clarify this without the system. 

[Discussion off the record. ] 

BY Ms. as 

Q__ Sorry, did you -- 

A I'm still trying to figure out the best way to explain this. It's really, really 
hard. And|I work in our system, so | -- it can come in and it cannot be tagged because 
someone didn't find it to rise to the level of actionable or need a bigger review within the 
area of responsibility. Again, that information would still go into our data lake, and 
would still be being searched for other things by our, for lack of a better word, like 
analysts that are just doing that. 

Those that are tagged are going to bubble to the top and we're -- because we have 
to prioritize, and so, that was kind of that mechanism of prioritizing. So | cannot tell you 
exactly at this moment if there were only 43 Guardians still tagged to this event. At that 
moment, that was the 43 we were looking at. 

Q_ Sothen, the remaining question is, how many tags were there for Guardians 
uploaded about January 6th? So just to zoom out, like the inquiry from the committee 
has been about the threat landscape going into January 6th, right? 

A _ Right. 

Q  Howdo you assess that from the Bureau side? Oh, it's the Guardian 
system. So then the response has been, on December 27th, this directive came out, 56 
offices, everything was hashtagged, so this is what we knew. But it sounds like what 


you're saying, is there information that was not with the hashtag that still exists, but 
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we -- and we don't -- how do you -- how do you quantify that? 

A It's difficult, like, right now. If you were asking me on January 5th is -- well, 
we have this, right. But exactly the totality, how many have been tagged, because our 
system doesn't tell you -- like you can't historically go back in the system. So if you get 
tagged on January 7th because somebody realized it actually related to January 6th as 
they're doing other things, it's not going to give me that number. __It doesn't tell me that 
only on this date. __It just tells me the totality of what's tagged. 

Q Okay. So-- 

A | don't have that number for you. At the bottom -- at end of the day, | 
don't have that number. 

Q_ _Isthere anumber that the Bureau can provide? Does that number exist? 
Because here's how it stands, and this is a little bit off -- 

A Yeah, yeah. 

Q_ -- but either we, you know, as we turn this corner and head towards what is 
a report-writing exercise, prior to this interview it was the Bureau had 43 Guardians as of 
January 5th. And those -- that is the universe of threats and tips about January 6th. _ If 
that is not the case, which sounds like from your answer it is not, then that's something 
that is relevant that we should, you know, obviously take into account. 

Ms. Greer. | think acouple of things: First, EAD Moore can speak to and what's 
reflected in the documents as to what WFO was aware of and seeing at the time. The 
second piece is, of course, we're taking a look at backwards looking and going back and 
looking at things. To the extent that we have uncovered additional information, | think 
we can figure out a way to get that to the committee sort of based on what we've learned 
since January 6th. But in terms of the snapshot in time of what WFO was seeing in 


advance of January 6th, that's what's reflected in the emails and what EAD Moore can 
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speak to. 

Ms. So the very -- just to add the caveat about the 43 Guardians is 
what WFO is tracking, it is not the universe of what the entire FBI was seeing about 
January 6th as of January 5th? 

Ms. Moore. | don't think we can answer that for the entirety of the FBI, because 
| can only answer to WFO. So -- and | know you -- | know I'm frustrating you, and I'm 
really not trying to. 

Q_ No, | get -- no, | get that, but you've also said that you do have the ability to 
see everything -- 

A Correct. 

Q_ --and we also know that the hashtag went to 56 field offices. So where do 
you -- where's the line? _ If it's not 43, is it a larger number that exists? Do you 
understand my question? 

A | think you're asking -- | -- let me ask you if this is what you're asking me. 
You're asking for every person that called in that provided some information to some 
degree, regardless if it was valid or not, do| have that number? That number is not 43, 
right. 

Q Okay. 

A So that is different, and that is where | keep talking about there's this lake 
and my team is fishing in that that lake and searching, right. What | can tell you is that 
the ones that were -- and it may be that on that day, on January 5th, for the totality of the 
government, there were -- or totality of the Bureau, there were had 43. | can't 
100 percent confirm that, because we did have stuff that got tagged in there that might 


actually be the inauguration, or got just inappropriately tagged. | can tell you that on 
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that day we were looking at 43 Guardians. 

Q Okay. Andlappreciate that. And | think, just so | understand, there is 
some level of assessment that occurs before it is tagged? 

A Correct. 

Q Okay. Oh, go ahead. Sorry, i. 

A And it can be tagged at any point. 

Q feed | promise you we're going to you. | OE going to ask one. 

——ae Thank you. 
| 


Q | want to -- we talked about the tunnels. | want to go back to the tunnels, 
because you said I'd love to have it in front of me, so I'd like to give you that intelligence 
now. 

A Okay. 

Q_ This is -- | know that, or at least we believe that it was something that the FBI 
had listed as Guardian and SENTINEL case due to it coming into their NTOC, is what -- this 
is the assistant Chief of Police of Capitol Police. They forwarded it internally, this tunnel 
information, and they said that they got it from the FBI. So believe it's something that 
has been before -- that you've seen before, but | just want to give you the raw 
intelligence and see if you remember it, because you said it would be nice for you to see 
it. 

A Sure. 

Q But just with that caveat that I'm giving you something that | believe from 
other sources would have been something the FBI, particularly, | assume, the Washington 
Field Office, would have seen. But first, | actually just want to read it into the record, 


some of the rhetoric that's on TheDonald.win concerning the tunnels. 
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Q Can you wait for the question? 

Ms. Antell. Can we not read it into the record for that reason? 

VV ae This is a piece of intelligence that -- this has gotten -- we got this 
from the Capitol Police, so it has -- why wouldn't we be able to read something -- 


Ms. Antell. Is it public? 


Va Yeah. Yeah. 
Vs Yeah, it's from TheDonald.win. 


Mr t's been reported and put out there. Everyone has seen this, I'm 


pretty sure. 


24 


25 


96 


Q Okay. Let me ask you about number 4 on the Guardian list and then we'll 
get to 

This is a complaint from North Carolina stating there was a TikTok video with 
someone holding a gun saying, Storm the Capitol on January 6th. This screen shot of the 
TikTok user reads, | am an enemy of the State, and January 6th storm Capitol under 
username. Can you just run through for us how this particular Guardian -- | think it did 
get closed. Yes, it was closed, so how it got booked? 

A It was shared with all of our partners. 

Q_ And this would be, again, orally over phone calls? 

A Yes. It was probably -- it could've been both, and | cannot speak to that 
specifically. We shared it through emails, potentially through an oral brief with our 
partners, and through the dissemination to the JTTF. So this would've been shared with 
our partners. 

Q Why wouldn't it merit any further action, either a product, something 
written, action? 

A So no gun was actually present in the actual post. The user picture was a 
shadow holding a weapon, but it wasn't an actual gun. 

Q Is that -- is that the only -- you know, there was -- had you seen intelligence 
of -- with people talking about coming armed to D.C. with actual guns in the -- 

A We had seen intelligence that where people were saying come armed, bring 
your arms. | mean, we had shared that with our partners. And if | remember 
correctly, the mayor put out a thing saying, Hey, it's illegal in D.C. to bring guns. Don't 
bring guns to D.C. So that wasn't something we were not aware of. 


Q | guess what I'm trying to understand is, let's say, if it wasn't a shadow, it was 
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a person, you're telling me that that would've been enough, sufficient for -- that was the 
only reason that there wasn't further action taken? 

A This was opened as a Guardian incident, so very -- it's not the only action. 
So we do a litany of database searches, checks, open -- open-source information. _ It's 
not like one or two things. It is pages of checks that we have to go through on every 
Guardian incident that we have. 

Q__Ididn't say only action. _| said it's the only -- you said that the determining 
variable here, the reason why there was nothing further to be done was -- | just want to 
clarify what | was saying. 

A | apologize. So thank you for clarifying my statement on the record. No, 
that wouldn't be the only thing. It would be the totality of the information that we were 


able to do in our workup. 


Q Okay. 
oy Ms 
Q_ |just had a couple of questions about TheDonald.win generally. Was that 


something that was being -- was on your radar? 

A Yes. 

Q And were there -- | know from public reporting there was entries about 
TheDonald.win, or information that was provided to the Bureau about it. What -- what 
step, other than it being on your radar, did you take in terms of monitoring 
TheDonald.win? Was someone -- were you getting daily updates about it? How does 
that work? 

A So we use social media exploitation tools, and those have specific searches, 
particular searches that are entered into it. And so, we were getting hits off of that 


website. But specifically to troll Donald.Win, again, what people post on Donald.Win is 
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1 First Amendment-protected activity. | can't just specifically troll one website. 

2 Q And when you said you were using -- I'm sorry, the word was you were using 

3 centers to help you kind of go through those sites, what was that, the social media 

4 research? 

5 A We have social media exploitation tools that we utilize. 

6 Q And whyare those used versus the people in your own unit? 

7 A We use both. 

8 Q Okay. 

9 A And we did -- and during this course of this we used both. 
10 Q_ And that was -- wasn't -- was there a particular name for that? Were you 
11 guys Dataminr and ZeroFox? 
12 A So there were two. Soup until January 1st we were using Dataminr and 
13 then we moved to ZeroFox. 


14 Q I'm surefJwill get to it. 
15 Vie We can ask now, unless you're going to ——— 
16 Vs Sure. [EBB§ did you have a couple -- did -- 


17 Mr. (Ob, there he is. 


18 Me Ido. |'d love to ask a couple questions, if that's okay. 

19 Ms. Sure. 

20 Vr. First, I'd like to say hi to Megan and Kira. And | think | saw Mark 
21 inthe corner. I'm not sure. 

22 It's nice to have a SAT talk to us as the head intel professional inside WFO. | 

23 think this is a unique opportunity for us to, you know, talk about process and procedure. 
24 And my questions are going to focus on process and procedure, and | apologize for that. 


25 We will probably be retreading, revisiting some old topics. 
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So | wanted to clarify, | wanted to ask for a bit of clarification. | think you've 
done this like seven times already, but | wanted to make sure that | was understanding 
this, the notion of tips and leads that come in, Guardians, right. And |'m going to 
describe my understanding, and if it's okay, if you can kind of, you know, pick that apart 
or tell me if I'm -- if | got this right. 

The Reporter. Can we turn the volume up? 

Nia Can you just talk directly into the microphone? Yeah, sorry, it's a 


little muffled. 


vie Okay. So is that better? 


The Reporter. Slightly. 

Ye Hold on one sec. Let meseeif|can-- better? Marginally. 
Sorry. I'll try to be louder. 

ye 

Q So there's -- you know, not all tips and leads become Guardians. The 
Bureau at NTOC receives 1 million, 1.5 million tips, leads from the public from all sorts of 
sources, right? 

A Correct. But you're using two -- you're using two words there, so let's stick 
to the word "tips." So they received tips. 

Q Yeah. No-- yeah, no -- millions -- a million and a half leads a year, or a 
million leads -- oh, sorry, tips coming into NTOC. There's a triage that's in there. That 
triage system pushes some of those tips into Guardian, right? 

A That is correct, yes, sir. 

Q Yeah. And also, Guardian leads can be generated outside of this process. 
They can be generated to cases, from -- alter the casework by FBI agents, by a task force 


officers -- 
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A Correct. 

Q- --right? Yes. 

So NTOC keeps a database of all of the tips that they receive that don't reach 
Guardian threshold, don't become a Guardian, right? 

A Correct. 

Q Soin Guardian you have open Guardians that -- Guardians are, first, you said 
treated in a pre-assessment kind of state unless it's patently obvious that they become 
one-two, right? 

A Yes, sir. 

Q Okay. Then they become one-two potentially. Those that don't are 
closed, but they stay in Guardian. They stay as documents that can be searchable in 
Guardian? 

A _ Yes, sir, and searchable in our SENTINEL system. 

Q Okay. Right. Guardian is in SENTINEL, of course, yeah. 

So you've got -- from what I've heard, you've got the NTOC of tips that don't 
get -- don't make it into Guardian. You've got open and closed Guardians within 
SENTINEL. You've got SENTINEL case information that you have to look at to assess a 
threat, this is at the very least. You've got SOMEX research that you're doing that may 
be appended to a Guardian, may not be appended to a Guardian, may be appended to a 
Guardian, may be pre-assessment, may not be pre-assessment. And all of that stuff has 
to be kind of assessed to understand a threat in the AOR, at the very least that stuff. 
There's other stuff as well, right? 

A Yes, sir. 

Q_ [think you had mentioned DIVS earlier. Is all of that stuff available in one 


place for analysts to look at? 
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A Do you mind expanding upon by one place, are you -- like a single sign-on 
and they're in that system? 

Q Yeah. 

A No, sir. No. 

Q Very arduous to kind of perform this crosscutting analysis, investigative 
work, looking at different systems, trying to connect dots, | would imagine? 

A It is their job, yes, sir. 

Q Okay. Nowl'd like to ask a couple of questions about the SIRs versus IIRs. 
And | think -- | just want to clarify here, because | think we may have glossed over the key 
differences between SIRs and IIRs, if that's all right. 

A Yes, sir. 

Q_ Sorry, Megan, did you -- 

Ms. Greer. Nope. Go ahead. 

ye 

Q Oh, okay. Sorry. Now, it's my understanding, please correct me, an SIR 
can be multi-sourced? 

A Yes, sir. 


Q_ Itcan have alittle analysis in it? 


A Yes, sir. 
Q_ And it can go out to law enforcement and the IC? 
A Yes, sir. 


Q_ The difference between that and an IIR is an IIR is usually one source, right? 
A Yes, sir. 
Q Usually classified, or at least FOUO, and it -- there is no analysis appended to 


it usually? 
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A Yes, sir. 

Q_ And it generally goes to the intelligence community and task force officers 
who have -- who are on Joint Terrorism Task Forces, or are plugged into IC systems? 

A Yes, sir. 

Q_ So there is a substantive difference between an SIR and an IIR, and there is 
some investigative or analytic kind of value to choosing one or the other? 

A Yes, sir. 


Q_ Right. Which one is easier to do? 


> 


IIR. 

Q Can you tell me why? 

A It's purely raw intelligence that's disseminated in the form that it comes in 
with absolutely no evaluation to it, other than what you read in the information, period. 

Q Switching gears a little bit, we've talked a lot about Type 1 and 2 
assessments, one category essentially now. They were established after the 2008 
attorney general guidelines were released, some CASIC (ph) guidelines if remember 
correctly. These focus on individuals or groups and they're meant to generate at 
least -- | think initially they're meant to generate kind of preventive sorts of investigative 
effort, right? | mean, that's why they exist? 

A Yes, sir. 

Q_ And this is post 9/11, of course. 

And the bulk of this work that you described in WFO related to January 6th was 
about culling through all of that raw information and intelligence and trying to 
understand whether Type 1 or 2 assessment should be opened up and then working 
those -- running those to ground, or helping other field offices run those to ground? 


A Yes, sir, along with our social media exploitation, but, yes, sir, that would be 
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the bulk. 

Q Great. So you're essentially looking at individuals or small groups 
independently as part of those assessments. That's why those are designed like that, 
right? 

A Yes, sir. 

Q_ They're not big picture? 

Not as a stand-alone item, no, sir. 

Q_ As the intelligence professional at -- the head intelligence professional at 
WFO, | mean, you obviously have -- you know the DIOG inside and out. You know the 
assessments inside and out. Can you tell mea little bit about a Type 3 assessment? 

A Yes, sir. A Type 3 assessment is something that we can open on an event 
specific, that it can't be just based off of a First Amendment activity or protected activity, 
it has to have a lean towards some type of violence or threat to that activity, to that 
normally First Amendment-protected activity is what we open that up, and that is to gain 
a greater perspective of what is occurring within our area of responsibility for the bigger 
picture. 

Q__ This is exactly what I'm -- what | was interested in is Type 3 assessment. It's 
my understanding, and please, again, amend my understanding if | am wrong here, but 
the Type 3 assessment was designed essentially to be anticipatory and 
intelligence-focused, right, to understand threat in the AOR, to go beyond Type 1 and 2 
assessments where you are looking at individuals or small groups? 

A Yes, sir. 

Q Could you tell me how many Type 3s were opened regarding -- from WFO 
that covered -- if any, that covered January 6th? 


A We had one Type 3 open that covered that event. We were -- it was titled 
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PBCA, so we were -- we had used it also for a MAGA |, MAGA II, the actual Election Day, 
yes, sir. 

Q And that Type 3 would capture -- presumably capture the material in the 
NTOC database perhaps, perhaps capture information in the open and closed Guardian, 
so SOMEX information, any other SENTINEL-related case material? 

A It could be, sir. It captured a lot of what we were seeing, like you said, on 
social media, and then other information could be uploaded into that Type 3 as well to 
help form that greater picture within the area of responsibility. 

Q  Somy assumption here is that if you've got a one Type 3 assessment, 
several, a handful of Type 1, 2 assessments in -- by WFO, are they receiving equal 
attention? Are they receiving equal investigative intelligence support, or does 
one -- does one trump the other? 

A No, sir. They're very equal in the sense of everything has to be worked and 
everything has to be addressed. We have different individuals who may be, their 
primary responsibility is working the Type 1 or Type 2 where someone else might be their 
primary responsibility the Type 3, but they're all collaborating and communicating 
together, working for the greater end result. 

Q Okay. Thankyou forthat. So ifthe people working the Type 3 
assessment, they're aware that there are 43 Guardians out there roughly, whatever the 
number is; they're aware that there's lots of violent rhetoric out there based on a variety 
of data sets that they have access based on -- presumably based on the NTOC database if 
they're actually looking at that; they know that the Proud Boys are coming, a violent 
group that presumably the FBI has cases on; they know that Oath Keepers are coming, 
again, a group that presumably the FBI has open investigations on; they know that the FBI 


has tasked sources, it's DT sources from headquarters to understand the threats, 
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presumably, why isn't -- why wasn't all that information worked into some sort of product 
out of the Type 3 assessment? So the Type 3 assessments, | presume, are also the basis 
for the development of all sorts of intelligence products? 

A At that moment in time, we made a decision to use our briefs as the means 
of sharing that information, because we felt, at that moment in time, that we were 
reaching all of our partners timely and effectively with the information that we were 
providing. 

Q | would imagine that's such a difficult -- that such a determination would've 
been difficult to some degree, challenging, looking at the resources you had in front of 
you, and looking at the problem, the problem set and the threat streams. 

With that, is it possible that if the -- that if -- and we're just talking about WFO, 
WFO informs its counterparts about this threat strictly from Type 1 and Type 2 
assessments that look at individuals and organizations, and essentially the bottom line 
from that story is that we don't have actionable intelligence suggesting specific violence 
involving those individuals, that you're missing a big part of the intelligence picture that 
you have in the Type 3 or in other repositories? 

A If we were only using the Guardian -- let me ask you if | understood that 
correctly, so | apologize. 

Q Okay. 

A You're asking me if I'm only looking at the Type 1, Type 2s, would | be 
missing other things inthe picture? Absolutely. Absolutely. That would be an 
incomplete -- we would never do that. That doesn't give you a full picture, correct. I'm 
sorry if | didn't relay that to anybody, which | thought. 

Q_I'msorry, EAD Moore, | keep jumping over you, and | apologize to the court 


reporter as well. I'm trying to be loud and -- so that you could hear me, and | apologize 
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for jumping over your comments. 

Not so much necessarily from your perspective for this question, but imagine 
yourself, if you will, in the seat of an 1,800 series investigator or an intelligence analyst 
who's not in the FBI, and the only information they get -- and it's a decent amount of 
information, but the only information they get from the FBI suggests no individual, no 
groups, no credible threat from those individuals or groups. Those are -- there are no 
individuals or small groups that have issued, suggested, shown credible threat that was 
actionable or very few of them. That looks to be -- that seems like a picture that, in 
most cases, would be a natural result from focusing a lot of the release of material on 
Type 1 and 2 assessments? 

A So, yes, sir. So that's why we don't dothat. So, again, like off of our Type 
1 and 2 assessment, we're gleaning intelligence looking for investigative cases. But 
that's where that Type 3 ties into that bigger picture that we're briefing everything that 
we're seeing coming off of our social media exploitation, CHS information, because that 
wouldn't necessarily be in the Guardian itself. So we would never write a threat picture 
off of just a Guardian's, no, sir. 

Q Right. The default picture that the rest of the community receives is 
almost -- like the key information, the information they key on, they focus on is the 
Guardian stuff. The Guardian stuff that is focused on -- that leads to Type 1 and 2 
assessments that essentially says that individuals or smaller groups are not going -- not 
showing credible violence -- potential for credible violence leading up to January 6th. 

| guess what I'm saying is, or what I'm asking is, if you're focused on releasing 
information largely related to that, to those assessments and to that sort of Guardian 
information, it really shapes your total picture of the story, especially if your Type 3 


assessment you're not using it to inform the people who work -- | mean, it's an 
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AOR-focused assessment, and you're not necessarily pulling together the material in that 
assessment for some sort of holistic picture for the actual AOR. | mean, that seems a 
little challenging to me, a little troubling. Could you please kind of expound? 

A Again, we were briefing the information from our Type 3, and we were 
utilizing our Guardians as additional point. We were in regular communication with our 
partners to see what they were seeing, if it was different than us. | think we've had that 
takeaway already, and I'll reiterate it again is that, would we do things differently? One 
of the things that | think obviously is top down, bottom up, making sure that what we 
were briefing out was going to the highest level of people. Would it have been 
now -- could we see doing a product? Sure. Would we have leaned harder into maybe 
CHS's -- | mean, we would -- those are things that you would, with hindsight 20/20, yes, 
Sir. 

Q- Right. | mean, the Type 3 is a vehicle that you can -- you use to 
communicate a whole bunch of that material that may not rise to the threshold necessary 
to investigate an individual or a group for a violent activity for a crime, you know, possible 
crime. 

And so, again, is this something that would -- | guess, I'm curious, whenever there 
is a special event, a concerning rally, protest in your AOR, something that you suspect 
might have some violence appended to it, the lives and security of the protesters 
themselves might be challenged by the violence or endangered by the violence, is there 
an automatic opening of a Type 3 assessment on that event to understand the AOR, to 
understand who's coming in, to get a totality of the information, a holistic picture? 

A Is there an opening of a Type 3 to get a holistic picture whenever we have a 
large event that could have -- and this doesn't sound to be like -- I'm not trying to be 


evasive. But we, again, have to look at it really closely. We generally open a Type 3, 
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specifically in the Washington Field Office because of where our area of responsibility lies 
in conjunction with a legal review to ensure that we're not infringing on anyone's First 
Amendment-protected activity. 

So there has to be some degree of violence or something that leads us to believe 
that there could be a threat to that protected activity for us to open that Type 3. But we 
always brief what is in that Type 3 to our partners as we get that information. 

Q Buta briefing doesn't necessarily have the same wage as -- potentially as a 
product or as some sort of summation of what's in the Type 3 in written format, like it 
doesn't have to be a formal product. _ If it, you know -- I'd imagine that, you know, 
writing [inaudible] far more [inaudible]. 

The Reporter. I'm sorry, can you repeat that? 

BY MR. ie: 

Q | think a written product or an element drawn from a Type 3 for a process 
established to -- that mandates or requires for any event that has a potential for violence 
or threat -- the threat of violence that a Type 3 be opened, and that there be some sort of 
product that is disseminated, either, you know, the written notes that are part of a 
briefing or a formal intelligence product. That carries some weight. A written product 
is far more, | think, effective or powerful than a briefing, you know, even if -- 

A But our SITREPs -- I'm sorry, | didn't mean to talk over you. | apologize. 

Q_ No, no, that's totally okay. A written product drawn from something like a 
Type 3 assessment has far bigger impact on consumers, and a far wider reach thana 
series of briefings. 

A So our situational reports were pushed out in written form, and those had 
the information that we were receiving from our Type 3, from our CHSes, from the case 


information on predicated subjects, along with what we were seeing in our social media 
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exploitation and the information that our partners had provided to us. So our SITREP 
that we produced had that information in it. 
BY Vs 

Q Just to follow up on that, was there one SITREP that was done by WFO? 

A WFO does situational reports, yes. Other agencies may do them as well. 
We produce a SITREP multiple -- not -- are you saying a singular one? No. Wereduce 
them like, | think we were doing them twice a day. 

Q_ As--okay. Those were the emails that we sent? 

A Yes. Yes. 

Q But are those the same thing as to what fll is asking about, a written -- 

A | think he's looking for a formal product is what he's asking me for, would it 
not have been better to write a formal product. Because of the way the information 
was coming in, and the speed of which we were investigating stuff and trying to develop 
it, we found that the most efficient way to quickly get that out was through the daily 
briefs and our situational reports. 

Q- Right. You made that point. | think his question is would a written 
product have been more effective, similar to how what -- 

A It might not have been as timely. So what | knew on December 27th is 
different than what | knew on December the 2nd, and writing a product and publishing a 
product is a timely process. It's not like | go sit down at my computer and | hack that 
out, and that's in a finished format that's good enough to go out to the community. 

Q But it -- how do you reconcile that all this information is coming quickly and 
that there is this evolving threat picture that appears to be meaningful with the fact that 
a written product is probably more effective for the consumers, meaning your law 


enforcement partners? 
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A So as we sit in this room, again, we're going to have a lot of takeaways from 


this, but our partners did not ask us for a written product. They asked us for briefs and 


SITREPs. 
vs 
Q Well, but -- 
A So going forward, absolutely. We want to bat 1,000, right? 
Q Sure. 
A And | wanted -- after a large event like January 6th, we're going to look for 


ways toimprove. And absolutely that is something we're going to take into 
consideration without a doubt. 

Q_lappreciate that. | guess kind of the bigger picture is that we know for 
January 6th there was no joint intelligence bulletin or any kind of threat assessment that 
was issued. And just as your reaction to the Capitol Police report that I showed 
you, it would have been nice to know, right, at that time when you saw that written 
product that we showed you here today. 

So, similarly, would you agree that had the Bureau put out some sort of 
intelligence bulletin written product, that that would have had some sort of impact on 
your law enforcement partners, perhaps more so than the daily briefings? 

A Perhaps. Again, they were not -- none of our partners, State, Federal, local, 
were not asking us fora one product. They were all part of the briefs, they were part of 
the information. 

Q  l|getthat. Butas the FBI is kind of a premier intelligence domestic law 


enforcement agency, do your partners need to ask you to put out a product or isn't that 
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something that's part of your mandate? 

A Absolutely not, they don't -- you're correct, they don't have to ask us to put 
out a product. | will say again that in the leading up days to January 6th, we had 
produced 12 different intelligence products regarding domestic violent extremists. We 
had produced two joint products with Department of Homeland Security, specifically on 
domestic violent extremism and domestic violent extremism as it related to law 
enforcement officers. Excuse me, violence on law enforcement officers, different 
product. So we had been producing products. 

| know that the committee is specifically asking me, come January 6th, with 
hindsight, do | think that | should -- by the very fact that you're asking me that question, 
clearly to me means that the committee thinks that | should. And| don't find fault with 
that. | think that, in hindsight, | want to take away from January 6th and absolutely do it 
better in the future so this never, ever occurs again. So if that's what | have got to do, 
then absolutely. 

Nia Would fixing the problem eventually involve directing intelligence 
and investigative resources that you have put forward [inaudible] hold your position in 
the future to have control over and focus more on the type of reassessment and to 
routinize that process so that you develop a record, a track record, well, if this had been 
back in 2020, looks like this and nothing happened. In 2021, here is another event that 
we did, and it was a Type 3, and there would be a [inaudible] on, there was a bit of 
violence on that one, et cetera. 

So then you start to get a sense of baseline of what it takes in terms of 
understanding what's going on in your AOR with regard to protests and being able to 
draw the appropriate information from the [inaudible] database, from the open and 


closed Guardian, from SOMEX, and from everything else that's such a positive in 
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SENTINEL. — Is there value in creating an established process or realigning resources 
toward Type 3 assessment that [inaudible] an inventory intelligence [inaudible]? 

Ms. Moore. | can only speak to how resources are assigned at the Washington 
Field Office. And at the Washington Field Office, we had adequate resources assigned 
to review our Type 3, to feed into our Type 3, to work our Guardian, those types of things. 
So that's what | can speak to. 

| can't say that to a larger Bureau resource function, I'm afraid | can't answer that 
question. |cantell you, again, from the information that we were working with in the 
Washington Field Office, our posture was going to be the same. We were going to 
continue to work our Guardians. We were going to continue to look at our Type 3 
assessment. We were going to continue to do our social media exploitation. We were 
going to set up acommand post. We were going to activate our specialty teams. And 
so | don't think a reallocation of our resources prior to January 6th would have affected 


those key functions that we were going to do. 


Vs | | | just want to be cognizant of Ms. Moore's time. | think 


| oS a couple more discrete topics. 
uv Okay. | want to ask a couple more questions, then I'll -- 


VV | appreciate your patience. 
PY. —_— 


Q___ | just wanted to go back to something from an interchange, [inaudible] 
something that | think you had regarding finished intelligence. And it is just that a 
SITREP is substantively, substantially different than an SIR or another piece of [inaudible] 
intelligence in its reach. And, you know, your key concern certainly is the WFO AOR. 


But with regard to protest activity, with regard to events, really, your AOR is the United 
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States, is the globe. And | know it's tough to have that broad a responsibility, but you're 
not going to reach that consumer database intelligence of law enforcement consumers 
with a SITREP. You're going to reach them with raw intelligence and finished 
intelligence potentially, right? 

A Is your question am | going to reach some -- an international partner witha 
SITREP that's been -- 

Q No, no. 

A -- focused on my area of responsibility, that answer would be no. 

Q_ [Inaudible]. So New York or Cleveland or Los Angeles or Portland or San 
Antonio? 

A So the situation of January the 6th, our headquarters also had the NC3 stood 
up, which did have that reach across the United States. And they additionally 
themselves were producing situational reports that were fed out to all of our field offices 
and could be pushed through to our task force officers as well. 

Q Thankyou. |havea final question. If it is singled out, | think, maybe we 
can get an answer. 

Do you think that your resources -- or a way that WFO allocates its intelligence 
resources focused more on opening investigations versus anticipatory intelligence 
[inaudible]? 

A No, | don't. That's two different things. So we have -- 

Q Could you please explain? 

A We have very different makeup for that. And so we have tactical resources 
that are focused on opening cases and providing that investigative type tactical 
information. And then we have very specific dedicated resources to that larger strategic 


AOR type view. Now, if somebody wants to give us more resources, I'm never going to 
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turn down resources. 

Q How would you -- | mean, | don't know if you could give me numbers, but 
how would you compare the bodies that worked on the Type 3 assessment versus the 
bodies that worked on various Guardian leads related to January 6th, within your own 
division? Were there far more people working Guardian lead, was it roughly equal, you 
know, Type 1 or Type 2 investigations, or it was roughly equal Type 1, Type 2, and Type 3? 

A So we're sort of getting apples to oranges here, and I'm going to try really 
hard to stay in my lane. Like, | don't like -- 

Q [Inaudible] the resources. | mean, bodies matter and eyes matter, you 
know. It takes multiple perspectives to fully understand something. And I'm curious, 
just like, roughly, you know, how many people? 

A | can't get necessarily into my colleague's lane. Like, | didn't appreciate 
Matt Alcoke's email comment earlier when he discussed intel and repackaging, 
repackaging my partner's information, and | didn't appreciate that. 

The Guardian network and that portion that's worked comes out of his stuff with 
special agents. Sol don't want to necessarily talk about how they were staffed. I|can 
tell you that my intelligence analysts cadre, and by that means both our intelligence 
analysts and our support operations specialists were divided up differently. So atone 
point, | think -- you have to also remember -- a snippet in time, right? There's still the 
rest of the world is going on as we're preparing for January 5th and 6th. And while it's 
all hands on deck, and it was most certainly we have the bulk of our resources there, we 
just have onesies and twosies out there that are still handling your bank robberies or your 
transnational organized crime type things as well or public corruption. 

But while we were doing this, towards the end, | had | know at one point at least 


26 specific resources dedicated just to that Type 3. And that's probably more than the 
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resources at that point running Guardian information. But! can't tell you exactly how 
many | had in there, because | didn't kind of look into that. But! do know that because 
we were so focused on social media as well feeding into that Type 3, that we had a larger 


amount feeding that towards the end of January 6th. 


Mr. Allright. [Inaudible] 
Mr RR Thank you. 
Nia Thank you. Thank you to all. 


Vi | know you -- it sounded like you may have wanted a break? 

Ms. Antell. | think we just wanted to find out about how much longer you have 
to assess what kind of a break might be appropriate. 

Vie Sure. No longer than 2:30, | would say. 

The Reporter. Are weon the record? 

Ve Oh, we don't have to have this on the record, no. Sorry about 
that. 

[Recess. ] 

Ms. Moore. | think i kind of alluded to it, to make sure that | was really clear 
on the Guardian system. So NCOS does take in information that is like abhorrent 
behaviors, we talked a little bit about like UFOs or things like that. They will put that 
into their drop lake, which is called TIPS. So that miscellaneous type of noise doesn't 
necessarily go into Guardian. | just want to make sure. Does that make sense? 

So there is like a TIPS thing over here that's different than substantive. And | 
know | keep talking about the layers of the onion, but the TIPS are just truly white noise. 


Stuff that goes into the Guardian is that stuff that we start peeling back into. 


Mr. —+s, Perfect. Thank you. 
vv 
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Q  Sowe know at some point, you know, there was tracking of predicated 
domestic terrorism subjects traveling to the area. And exhibit 2 counts it as four as of 
January 3rd, 2021. We've heard as high as 18, with 6 ultimately being dissuaded from 
the trip. So can you just like work us through the numbers? What is accurate? 

A | cannot work you through the numbers. I'msorry. | don't have the 
specificity. I'm sorry. 

Q_ Okay. Is this -- | guess, is this right that as of January 3rd at least, that it 
says it's tracking four? Would that be accurate? 

A If it-- yes. |-- 

Q You have no reason to believe -- 

A __ Ihave no reason to believe that's not accurate. 

Q Okay. Do you know if it at some point could have grown higher, or could 
that have been you -- know, the number that you were tracking kind of reduced once you 
figured out whether they were coming or not? Can you like just walk me through how 
the number might change? 

A So | think what | can walk you through and explain, trying to stay out of some 
of my colleagues' lanes there, is that we -- the -- I'm going to give you a different example 
and then get you back to this one. Right? 

So in the Las Vegas Field Office, Las Vegas has lots of big sizable events that people 
like to come to. So let's say a big boxing match for a championship, right? Lots and 
lots of different type of subjects like to travel to go see that boxing match. So if you are 
in Dallas and your subject's traveling to Vegas, you're going to let Vegas know or you're 
going to let your program coordinator at headquarters know, and they're going to let Las 
Vegas know. So it kind of works like that. So that information comes in in little dribs 


and drabs at different times. 
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So similarly to that, for January 6th, we were notified of different travelers that 
were coming to the area that were predicated subjects, sometimes by the local field 
office. Sometimes the field office had notified headquarters, and then headquarters 
would notify us, and ultimately headquarters put a message out to the field and said, hey, 
let us know who's coming. 

| don't know that exact number at this moment, exactly what we came up with. 
But what we said was, we have a very specific plan that we need to know. _ If your 
subject is traveling to our AOR, we need to know, how do you have him covered? How 
do you know this? Do you know anything sensitive about it? Like, hey, we're coming 
to do violence or we are just coming to do a First Amendment right -- First Amendment 
protected activity. We don't want to interfere with that. Do you have a mitigation 
plan? Can you go out and talk to your subject? Do you have the ability to do that? 
Not interfering with their protected First Amendment right. 

So that was what we were asking for. We were like, hey, go out there, we want 
to know why all these people are coming. Get us as much information as you can about 
that. 

Q And you said that part of that information was about whether they were 
coming to attend a First Amendment demonstration or whether there was indications of 
violence you said. 

A Sure. 

Q___Did you receive any information as to the latter? 

A Not with specificity that we're going to come and storm the Capitol, no. 

We know that some of them wanted to come armed, but | don't have that specific 
information, no, so -- 


Q Okay. But you recall at least armed -- you mean you don't have specific 
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numbers for me as to how many, but you do recall that some of the information you 
received from the different offices or whoever was tracking them was that some of 
theme wanted to come armed? 

A Yes, sir. 

Q Okay. Is there anything else in terms of -- you said that their -- nothing that 
rose to a certain level, you know, as specific as storming the Capitol. But was there 
anything else that you recall in terms of violence? 

A No, sir. 

Q Okay. So just the armed is what you meant when you mentioned that -- 

A It was the same rhetoric as what we had gotten. There wasn't anything 
with that generic, with that -- generic -- with that very -- it was very generic. 

Q What sort of rhetoric? How -- 

A Like, we're going storm the Capitol, we weren't seeing that. 

Q_ Right. 

A Or, hey, we're going to all group up as a unified force to do something 
that was -- 

Q But can you tell me affirmatively what you did here? You're telling me -- 

A | can't. 


Q Okay. Because you said it's the same sort of rhetoric, so | -- 


A It's that same, we're going to "stop the steal." 
Q Okay. 
A We're going to, you know, Make America Great Again. This vote wasn't 


legitimate, that kind of thing. 
Q Okay. Andis it right, you told me you don't know how many subjects 


ultimately made the trip? 
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A | do not know, sir. 

Q Okay. Outside -- you know, you received this notification. Is there 
anything else you did with -- you know, you asked them all to give you this information. 
Once you received that information, is there anything else you did? 

A Yes. So we pushed that all out to our partners. 


Q_ And in which ways, through SITREPs or -- 


A Through our verbal briefings and our situational reports. 
Q_ Gotit. 
A On a regular basis, we also briefed up our headquarters. Well, they knew 


it, we briefed it again in these -- we were doing it every 2 hour briefs. 

Q Okay. Were you involved at all or was there sort of a directive dissuading 
any of them from coming? 

A By a directive, do you mean did we try to dissuade any of them from 
coming? 

Q Sure. Yes. 

A Yes, we did. We asked again for our specific field offices that had subjects 
coming to go out, if they could. And it was kind of like a Hail Mary, like, hey, if your case 
allows and you can, go get in front of your subject and try to really like, hey, why are you 
goingtoD.C.? Because sometimes just us bumping a subject will prevent them from 
doing something. 

Q Okay. And /think |! anticipate your answer, but | want to get you on the 
record, of course. So those who did travel, was there any surveillance of their actions 
while they were here in the national capital region? 

A Was there any surveillance or actions on predicated subjects that were in 


the national capital region? 
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Q Yes. The ones that actually made the trip. 

A We didn't -- to my knowledge, no, sir, we did not conduct specific 
surveillance on those. We were utilizing some CHS coverage, | believe. But no, sir. 

Q Okay. And forthe record, CHS is? 

A I'm sorry, confidential human sources. 

Q Perfect. Were the identities of the subjects shared with your partners? 

A The specific names? 

Q Yep. 

A No, sir. 

Q Were their criminal histories or other background information 
disseminated? 

A __ They were known to be predicated subjects and we would have discussed if 
they were known for violence. 

Q Okay. So does that mean that you don't think that as specific as criminal 
histories you would have gone into? 

A I'm try trying to think -- 

Q You're trying to remember. No problem. 

-- like what -- exactly what all we were briefing for that. 

Q You know, as much as you can recollect, of course. 

A | would say that we did not go through each traveler's criminal history 
independently, other than providing that we had -- and remember that every traveler we 
had coming was not necessarily a violent subject. So you could have someone that's in a 
money laundering case that was coming to D.C. because they wanted to take -- you know, 
participate in a First Amendment protected activity. And so that wouldn't be quite the 


same. 
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BY VR 


Q Okay. A September media report in The New York Times indicated that an 


FBI handler remained in close contact with an informant from the Proud Boys before and 
while he breached the Capitol, and that the FBI had been investigating at least two other 
January 6th rally goers who the informant was directed to contact. 

| was just wondering if you had any information about that whatso -- 


A | do not. 
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Q Okay. | actually want to run just a number by you. I'm not asking if it's 
exact, but if it sounds right. The Washington Post had reported that TheDonald.win 
resulted in 190 entries in the Guardian system and 128 entries in SENTINEL. Does that 
ring accurate to you? 

A | do not know. 

Q You don't know at all? 

A No. 

Q You can't even tell me -- 

A Not -- not in the ballpark at all. | apologize. 

Q Okay. No worries. 

Okay. And then | do want to quickly -- we talked about it very briefly, the switch 
in social media monitoring on New Year's Eve, right, from Dataminr to ZeroFOX. In 
exhibit 3. | think there's a quote from -- | want to make sure | -- | actually don't know 
who it's from. | think it is redacted, but it's to you. And that -- 

A Therelam. 

Q That individual writes that, quote, Our social media abilities might be slightly 
degraded during this event as we are getting used to this new tool. 

And my question to you is, was that prediction borne out in your preparation for 
January 6th? Did it degrade your abilities even slightly? 

A It absolutely changed how we looked at social media. So this was beyond 
not the ideal time for this to occur, but in government contracting and contracting 
changes, you can't predict the future and when that change is going to happen. | would 
have preferred it not to have occurred in this moment, without a doubt. 

What we did is we adapted differently. Sol considered Dataminr like | need to 


go dig a ditch and I'm going to use a backhoe to dig that ditch. And1|can do that with 
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Dataminr really quickly, right? But when you dig that ditch, you get really giant piles of 
dirt, and your edges along the ditch aren't that great. What we did then was we pulled 
26, roughly, more analysts in to the picture, and we had them dig it with a shovel. Like, 
they just did it by hand. It's the old school way, not ideal. 

But what the benefit of doing that is Dataminr does report everything it sees in 
those grabs. Like, you set your search term up and so it grabs everything it can, right? 
But it's not very specific, so it creates a lot of noise. So when you dig it by hand or 
you're going out there, you're very specifically searching, very -- and you're reviewing that 
information very instantaneously, and it's very direct. 

So it's a little -- it's different, more laborious. They all get to the same result. 

It's just differently and a different amount of resources that it takes to have to do 
something like that ultimately. And | have to try because there are some different 
techniques inthis. We have some very talented individuals within our organization that 


can write very talented script and were able to assist us. 
Ve | recall Nia | has a question he wanted to ask. 
vue 


Q Hey, good afternoon, ma'am. I've been the silent observer for a while, but 
| do have just one quick question for you. 

So | heard a lot about what isn't actionable, like, if it's related to First Amendment, 
if it's related to a protected class. | was wondering, sort of zooming out from a macro 
perspective, can you explain to us what is the threshold for something being actionable? 
So, in other words, what makes something -- | understand what doesn't make it 
actionable, but I'm trying to understand what does make it actionable. 

So a piece of information comes in about whatever, and you're making an 


assessment about whether or not it meets the criteria for the things it shouldn't be about, 
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right? Andso youdothat. How do you determine if what's left is actionable? 

A So | think she had a great example earlier when she said someone calls in 
and says, my cousin is going to travel to D.C. and they are going to commit X violent act, 
right? That's very specific. So now | have an individual | can recontact. | can find out 
who that cousinis. | can doaworkup on that cousin. | can do exploitation, you know, 
to see. So it gives me that specificity to be able to do more. 


Q So actionability -- if that's a word -- is tied to specificity? 


> 


Correct. 

Q  Sothe more specific something is, the more actionable it's likely to become? 
A Absolutely. But there's also this point too, like, when we're in the 
pre-assessment phase and even sometimes when we go into the Type 1, like, if | serve, if | 
get into a Type 1, | think | can action off of this, right? And serve a service order ona 
mail provider, an email service provider, right, and they come back. The information 
that they come back with, it may not be legitimate. And sol may be trying to run this 
down and, ultimately, even that becomes unactionable. Does that help at all? 

Q Yes. I think it does. 

So to oversimplify it a little bit, it sounds like what you're saying is that whether or 
not something is actionable is determined on a case-by-case basis, based in part on 
specificity. There doesn't, and correct me if I'm wrong, doesn't sound like there's sort of 
an overall set of criteria that you balance something against to say whether or not it's 
actionable? 

A | wish it were a checklist like that. It's simply not easy. Probably [iil 
should explain it, because he did a really good job earlier. 

But in all seriousness, every pre-assessment that is in the Guardian system has to 


go through a certain number of checks. Sothose are mandatory. And thenthere's a 
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whole other set of checks that is applicable to this. You know, you can -- and you can 
runthose. So there are certain things that you must do. And depending upon that 
stuff that you must do, if you get further information that you can action, then you can 
continue. 

Q Understood. lappreciate that. Thank youso much. Thank you all. 

BY MR. 

Q If you would turn to exhibit 7. You wrote to Steven D'Antuono, quote, | 
know you're getting peppered from the 7th floor boss, so | just wanted you to have this 
quickly. 

And "this" being an update on the travelers. First, just -- I'll ask you what you 
meant bythat. But first, to whom were you referring when you say the 7th floor boss? 

A _ The 7th floor is our executive management at headquarters. 

Q Okay. 

A So that would be like our deputy director, our executive assistant directors. 

Q Okay. Is that Mr. Bowdich? 

A Yes. 

Q_ He's a part of that? 

Okay. And just explain to me what you meant by that. And also, maybe tie in 
how involved were headquarters with the work that you were doing in your branch at 
WFO. 

A So we talked a lot about it. And the atmosphere, it's like, what we were 
seeing, we knew that -- the situation was making everyone uncomfortable, right? 

This -- all these events had suddenly come to a head together. _It was like a perfect 
storm. Like we said, we had all these six different events. All of a sudden they're all on 


the sixth day. We go from not having, initially early in December, not having a lot of 
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people coming in and to having a lot of people coming in, to seeing really a lot of people 
coming in. Source information is now telling us, hey, like, hotels are really booked up 
and plane tickets are really sold out. 

And, you know, all of those pieces are coming together now to go, okay, this is a 
really, really large event. And it makes -- it's nervous. Like, people were angry. We 
knew that that was reported regularly in the media, there were lots of tweets. People 
were angry. There was just this very electric atmosphere. And so everybody's making 
sure that everybody's on the tip of that spear driving forward. 

And so the 7th floor is going, hey, what are you doing? Are you doing this? 

And you can't help it. Everybody wants to -- it's not even Monday morning quarterback, 
it's Saturday quarterbacking, right, like before the game on Sunday, because they're like, 
hey, making sure they're thinking what I'm thinking. | want to make sure they're seeing 
what I'm saying. And so they're calling ahead, hey, did you do this, are you doing this. 
And they're just checking us. 

And so we're, like, hey, boss, | know you're getting those questions because that's 
the nature of these events. I'm going to give you what I've got right now just in a really 
raw form so that you have it so that you can articulate it if you get a phone call. 

Q Okay. And this may be more of the same, but if you could get to exhibit 19. 
And it will be on the -- on the first page of exhibit 19. D'Antuono writes, quote, What | 
could gather from the deputy is that the focus is no one knows what is going to happen 
and that scares them. So they want to know what the intel is and plan accordingly, but 
that is tough, because there really is no centralized role in this for Defense or the Federal 
Government components. 

Can you -- what did you take that to mean? Can you break that down for us? 


A So we talked about early on that our role at the FBI a lot is an assistant in an 
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NSSE. So for an inauguration, again, the role -- the main roles, like in those NSSEs, fall to 
Metro Police Department, who's charged with keeping the city safe; the United States 
Capitol Police, who is charged with keeping the Capitol safe, right? You have the Park 
Police because a lot of these events happen on their jurisdiction of Federal property. 

And so the FBI is just sort of, like, hey, I'm here to help if you want me to help, kind of 
thing. This really squarely falls into someone else's lane. 

So for Federal agencies, like, there are certain things we can and we cannot do, 
and we've talked a lot about those different things. And so, again, what WFO is doing in 
this preparation, I've repeated ad nauseam, | know you all are tired of hearing me, and 
we were continuing to go through our Guardians. We're continuing to use that Type 3. 
We're continuing to share information with our partners and do intel briefs. We were 
already up on an NSSE, so we were capitalizing on all of those extra meetings that would 
be occurring to do that. So that's kind of where we don't have the lead role in this at all. 

Q Okay. 

A Andeven if it had been an NSSE, we still would not have had the lead role. 

Q_ Andso that part about, you know, that scares them, is that sort of in line 
with what you were saying previously that the Saturday morning quarterbacking in 
advance, is that -- 

A So | cannot speak to my -- to you Mr. D'Antuono's choice of words with the 
term "scared." | don't know that that's just a descriptor, like, hey, they want to make 
sure everything's being covered. It's aworry. Like, you always, before a big event, it 
doesn't matter. It's not to say like that you're scared. You're not sitting back shaking 
by any stretch. | definitely never described deputies out Director Bowdich as scared. | 
would say he wants to make sure we're doing everything that we can, as proactively as 


possible so that we have the best outcome. 
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Q And what about his other choice of words, you know, the focus is no one 
knows what is going to happen? Does that mean that on January 2nd, that the 7th 
floor, as you put it, that they didn't feel that they were getting sort of updates or knowing 
what was going down or what the plan was, as it says here, what the intel is and the plan, 
or do you feel like that isn't accurate? 

A So | think January 2nd is still several days out from the event. So we 
definitely -- obviously feeding more information. Again, we just talked about that, right? 
Groups, travelers, hotels, airlines, busses. All of that is leading to that picture to go, 
whoa, there's a lot of people coming. We don't know what's going to happen when they 
get here right? We've had everything from, you know, building defacements to armed, 
you know, protesters and counterprotesters going at each other, to actually individuals 
with the same viewpoint fighting each other for no apparent reason, other than they 
bumped into each other in a crowded march, right? So we've seen everything up to this 
point. Andso| think everyone doesn't know exactly what's going to go on. 

If everybody thought that the Capitol had been stormed, then we would be saying, 
we think the Capitol is going to be stormed, we think that they should reinforce that. So 
| think this was just, again, that overall picture of, hey, nobody -- we know we've got a lot 
of crowds, we see all the rhetoric, we know it's hostile; we're not sure where that's going 
to be directed. 

Q And inthat same thread, this is Mr. Alcoke saying, if there's info, we haven't 
yet seen indicating the FBI should plan to have a larger role in this, i.e. newly designating 
January 6th as an NSSE or a likely critical incident will develop a response and a staffing 
plan. 

My question to you is -- you sort of talked about it, if you could just expound a 


little bit more. You said that, you know, FBI still wouldn't be the lead agency if it had 
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been designated an NSSE event. Why wasn'tit? What were -- were there 
considerations of doing so? Is that just -- is that indications if there's a future, or you 
meant that January 6th -- or not you, but January 6th, 2021, had the potential to be 
categorized as an NSSE, or that never really was a consideration? 

A That wasn't anything that | was part of a conversation with. Sol can't 
speak to if at Matt's level, with his counterparts, if he was speaking to it being an NSSE. 
| think we were all seeing it grow really, really large. 

Q Would it have helped you in any way? _ | don't know if it -- what would it 
have given you, if anything, if it would have given you any sort of benefit to have it be 
designated as such? 

A If it had been designated as an NSSE, the Department of Homeland Security 
would have been responsible for reducing a threat assessment picture in advance of the 
event. 

BY MS. 

Q_I'msorry. Canyou repeat that? It would have what? 

A It would have placed responsibility for producing a product in advance of the 
event on a different entity than us. 

Q  Onthe Secret Service? 

A It -- Department of Homeland Security. 

But, again, | want to be really clear. I'm not saying that anybody should have 
declared it an NSSE. That's not in my lane to make that call. And I'm not trying to push 
DHS in front of a bus by any stretch. I'm going to take my own learning lessons from this 
myself and go back to my agency. | am not trying to say that somebody else failed 
where | didn't, or something along those lines. 


Q No. lappreciate that. So the designation of an NSSE event essentially 
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puts the Federal agency and the Secret Service in charge. But in your mind, does that 
mean they would have put out some sort of product or is that still on the Bureau? 

A They would have put out some sort of product. 

Q = About the intelligence landscape? 

A Generally, before an NSSE -- because they're usually -- we know an NSSE is 
coming up, right? 

Q Sure. 

A We know every year that -- 

Q_ The inauguration is an NSSE. 

A We know, Right? So usually leading up to that, there is adequate time and 
preparation to produce that type product. 

oy 

Q If wecanturnto exhibit 22. It says on January 4th of 2021, quote, As of 
today, WFO has no information indicating a specific and credible threat. 

| just want -- | take it that that is your position, that all the way up until January 
6th and, of course, the events of the afternoon, that there was no specific or credible 
threat that came across your desk? 

A So this document is from some unknown entity to a different entity. | do 
not know where they were getting that information from. Again, their terminology may 
be different. Like, one of our takeaways after January 6th is that the credible threat, no 
actionable threat is misleading to anybody. Inside of our partners we all know what that 
means. That's actually a term that one of our partners uses that we adapted. Going 
forward, we're changing that terminology to be more clear. But | didn't author this. 

Q  Oh,ofcourse. Well, then | should have -- | should have -- more fairly, is 


that accurate that WFO did not have any information indicating a specific and credible 
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threat? And if you'd like, you can define for us, however -- you said you have used that 
phrase that, however, that -- you guys use that phrase -- and whether that was true or 
false, given that definition. 

A | think that sentence stand-alone NSSE is misleading, because we were using 
that at times in top of our SITREPs. And then it would then go on to say all the 
information that we have. So what it would have been alluding to is that we do not 
have specific action that we are anticipating violence on at this time at this place. 

Q Okay. And then talk to me about why that language, | guess, has been 
changed since. What's misleading about -- what is it that -- what is your fear that people 
will take away from the way it's stated here? 

A _ That we weren't taking the threat landscape seriously. That the social 
media posts, we didn't deem that all the rhetoric that we were seeing was credible. And 
that's not accurate in any stretch. It was making that bigger definition of a picture for 
us, not just that we didn't take it seriously or we didn't -- | think that's how that reads, 
and that's not the case at all. 

Q _Isit fair to say, then, that you did have information as to credible threats. 
And let's use that in like normal English. Do you feel like you did see credible threats? 

A Any credible threat or any information that we had -- so, like, we had threats 
to Senators or Congressmen, right? Wehad shared that. So there were threats that 
were shared, but threats specifically telling us what was going to happen to that day, we 
would not have. 

Q But you would use the word "credible." Do you feel comfortable saying 
those threats -- that there were credible threats? 

A Any credible threat had been disseminated accordingly, yes. 


Q- Allright. 
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A Anything that we felt that could be quickly actioned or handled, yes. 


p 


And you did come across it. It's a -- 


> 


Like, we shared information we had. 

Q It's anon-zero number. 

A | just want to make sure we're talking about the same apple, so | want to 
define it, right? 

Q Sure. Go ahead. 

A So did | have specific credible information that the Capitol was going to be 
stormed that day? No. Did| have other threat information that day? Yes. We had 
the threat information to some of the law enforcement, the elected officials -- I'm 
sorry -- elected officials, and so we were sharing that information. 

Q You keep stripping -- the importance of the question is the adjective, 
credible threat. So did you feel as though there were credible threats that came across 
your desk? 

[Discussion off the record.] 

Ms. Moore. It stillties me down. Obviously, we had credible threats, because 
we went through some of the Guardians that are now cases, right? So to say -- 

i You don't have to imply judgment. _ It's just a yes or no if there 
were credible threats. If it's yes, that's fine. I'm not trying to assert any sort of 
judgment on it. 

[Discussion off the record. ] 

Ms. Moore. I'm really not trying to dodge a question here. I'm just trying to 
answer it like specifically. 


By MR. 


Q Sure. 
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A At that moment in time, | would say that what we had, there was no 
unaddressed credible threat, that we were not in some capacity working that. | mean, 
we had -- again, we had threats that were opened and shared and pushed to different 
places. Did they specifically say they were going to storm the Capitol? No. 

| mean, we have threats. | don't know, again -- 

Q Yeah. I'mtrying to focus on the word "credible." If you keep stripping 
credible, then, yes, it's going to change the question. And so -- and even when you say 
there were no unaddressed credible threats, I'm reading that to mean or understanding 
that to mean, again, it's anon-zero number. So that would mean that they were 
addressed. Credible threats, which means, yes, there were credible threats that came 
across your desk. 

A Yes. Yes. 

Q And sol'm just trying to get -- 

A I'm sorry. 

Q lappreciate it. Thank you. 

The same exhibit notes that, quote, WFO expects the number of participants to be 
fewer than the previous times each time the numbers get smaller. 

| assume, given the way you've talked about this, that you disagree that that was 
ever anything that WFO put out? 

A | want -- this is not -- this -- and I'm going to -- it looks like a quote from 
somewhere else if it's not. Whoever wrote this, | can't speak to this. This is not what | 
was publishing. 

Q Perfect. That's all my question is. 

A This is absolutely not what | was publishing. 


Q WFO was -- did not expect the January 6th event to be smaller in numbers? 
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A Absolutely not. 

Q Okay. 

Especially on January 4th. 

Q Got it. 

Exhibit 24, on January 3rd of 2021, it's an email outside of FBI. It's an email 
Stephanie Dobitsch from DHS I&A appears to learn, at least she indicates that she hasn't 
yet determined a threat level for the week, this being Sunday, January 3rd. 

| just want to ask about your end. Would that be accurate? Do you feel as 
though by that point -- | guess I'm trying to figure out -- | know you're having all these 
calls. When are you and are you at each call putting out a sort of top level, threat level 
for the week, a threat picture, or are you just sort of giving individual pieces of 
intelligence, you know, pushing those out, or is there a -- what would have been in a 
written product, is there a sort of like top line, summary, threat level picture that's 
produced at these? 

A So when we go through these partner calls -- and you've got my -- the 
situation report, so you see what those are rolling up with. But on the partner calls, it's 
a roundtable, for lack of a better word, and we're going to -- and Metro is usually going to 
lead that. And Metro is going to say, or Secret Service if it was a meeting that we were 
capitalizing off of for the NSSE, right, or whoever the chair of that subcommittee is. 

So it will just go around the table, hey, what are you seeing? Hey, this is what 
the FBI is seeing. We've got X number of travelers coming in. We've got some stage 
coverage that's told us this. On social media we continue to see. And we would even 
tie it back to a platform perhaps, TheDonald.win or, you know, whatever that this is the 
type of rhetoric we're continuing to see. And then it would go to the next partner and 


the next partner and the next partner. So there wasn't like, today is my highlight, this 
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is -- | will call this red or yellow, not like that, no, sir. 

Q Okay. So your reaction to that is that could make sense, that on January 
3rd, Sunday, there might not have been a threat level for the week put out by FBI? 

A There's not a threat level ever put out by the FBI. 

Q  Andexhibit 21. I'malmost done. | know we're 1 minute over. On 
January 5th -- 

A | want to go back to -- 

Q Yes. 

A __ Threat levels for United States Government or for the United States are 
owned by DHS, not the FBI. | just want to make sure that we, like, are clear, because 
Bureau doesn't ever put out a threat level. 

Q Okay. Are there not an expectation that the Bureau might put out, again, a 
big picture idea of the threat, picture of heading into the week? 

A So to talk about this specific piece here -- 

Q Sure. 

A -- this talks about -- whomever wrote this. And| didn't write this. So it's 
talking about -- and I'm going to say is that at the morning deputy director meeting -- so 
Deputy Director Bowdich would be who | assume they are talking about in this piece of 
paper. And every morning at 8:00 there is a briefing. They go around the room, and 
there's a quick snippet of what's going on in the world, right? They would not have 
briefed January 6th at that meeting because we were having different meetings with 
Dave Bowdich prior to this. Like, there had been tons of meetings. This would not 
have been the right platform or time for the discussion for January 6th. So whomever 
fed this back, Ms. Dobitsch pulled it from the wrong place. 


Q Okay. On exhibit 21, January 5th, you're forwarded a list of the Members 
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of Congress speaking at the Ellipse. Why would that be something important for 


someone in your position to know, if it is? 


A 


| think that, again, we would be shared this if we were having specific threat 


against those individuals, and to kind of just give us an atmospheric of who's going to be 


there and if the crowd's going to get bigger. 


Q 
A 
Q 
A 
Q 


A 


Okay. Soasa function of Members of Congress might draw larger crowds? 
Sure. 

And not in terms of the rhetoric or they would be -- 

We would have looked at all of that. 

You would have? 


Yeah, sure. We would have looked to see. | mean, we were going to look 


to see if we have actionable threats against them that we had shared over to Capitol 


Police, to make sure they're aware of anything -- 


Q 


A 


Q 


A 


Q 


| meant the rhetoric coming from them, coming from Members of Congress. 
Oh. 

Not directed at them. 

I'm so sorry. 

That's okay. | assume your answer is different? 

So would you mind asking me the question again now that I'm not -- 

Sure. No worries. 

-- inside threats to them. 


Only other function of how much -- how popular the event might become 


because of their attendance, not necessarily because of the rhetoric they might employ 


or have been employed in the leadup to January 6th? 


A 


Correct. 
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Q At this point, I'd like to ask you about what were the major lessons that you 
took away from January 6th? And these are my wrap-up questions, so we shouldn't be 
going -- 


Ms. ae Can we do one more question before that? 


VV Yes. 
vs 


Q | just want to ask you about certain reporting that occurred soon after 
January 6th, including in The Washington Post. And one of the statements was from, 
who | think from the chain of command would have been your direct boss, Steve 
D'Antuono -- is that right? 

A Yes. 

Q_ --who stated to reporters that the agency did not have intelligence 
suggesting that the pro-Trump rally would be anything more than a lawful demonstration. 
Is that a correct assessment of what you were seeing? 

A Again, | can't speak to specifically 
Mr. D'Antuono. What|I can tell you is that we did not have that actionable piece of 
intelligence that would have allowed us to know what that crowd was going todo. And 
that was one we were monitoring. That we had believed that these groups, when they 
had shown up for MAGA 1 and MAGA 2 and other events, had violence tendencies. 

And so for him to say that we had -- his indication is, did we have anything that 
indicated it was going to be other than a First Amendment protected activity? | don't 
think that's unfair to say that that's accurate, limitedly. Like, | didn't have a smoking 
gun, but | knew that | needed to be aware, and that we were concerned with this many 
travelers, this big of an event. And the previous violence we had seen in the city and the 


rhetoric that was out in social media and in the news, that we needed to be aware. That 
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was the reason WFO had taken all those proactive steps to additionally -- remember, 
we're running a 24-hour command post at this point because we are concerned. 

So, again, | don't have a smoking gun, but | am continuing to draw intelligence and 
desperately trying to stay in front of this to the point that | put my, you know, specialty 
teams and brought in specialty teams from other areas to sit in case this went bad. 

Q But there was certainly information that suggested, taking out the word 
"actionable," taking out the word "credible," that suggested it could be more than just a 
First Amendment pro-Trump rally. Is that fair? 

A | would say that we were on ready standby in the event that this became 
violent. How it might become violent, we did not see the storming of the Capitol. We 
were, again, going off of what we had seen in the past, which was the 
protester-on-protester violence, damage to property, that type of stuff. 

Q_ The -- the other questions -- | know you've mentioned a lot about being in 
touch with your partners and this was kind of your forum of communicating the threat 
landscape. Steven Sund, who was the chief of police at that time, said that he never 
received that FBI -- the Norfolk, Virginia, intel product, and that this would have impacted 
how he would have planned going forward. 

Do you know how that was shared, if that was shared with Capitol Police prior to 
January 6th? 

A It was absolutely shared with Capitol Police prior to January 6th. This is 
one of our takeaways after January 6th. So we use the Joint Terrorism Task Force across 
the country. We use our task force to share information back to our partner agencies. 
And they share it backwards and it goes up their chain. 

After Chief Sund has made the statement, that is where we -- that's one takeaway 


from January 6th was obviously the intel that we were sharing wasn't getting where it 
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needed tobe. And so to fill that gap, we now go from the top down as well. And we 
have those chiefs' meetings regularly before a large event, to ensure that they are 
hearing it from us, from our heads of office, to their heads of office. So bottom up, top 
down to make sure it gets there. 

Because, | mean, | think even with that intel product that we talked about 
that Capitol Police produced within their own agency, it didn't make it all the way to their 
chief. 

Q But during these briefings and the roundtable discussions, what level are you 
communicating to at the Capitol Police and with your interagency partners? 

A With our interagency partners at Metro, those are like deputy chiefs. 
They're one under. | cannot tell you what level it is at Capitol Police. | know they were 
participating. Beyond that, we have all of our task force officers that are getting that 
same intelligence. But it's generally a responsible party from that agency that has been 
designated to share and receive intelligence that attends those meetings. So it's 
different levels at different ones. 

Usually it's one -- a lot of our partners, it's one under the chief. Like, for me that 
goes, it's my supervisor senior intelligence analyst over that threat landscape. And one 


of our assistant special agents in charge go as well, so one under us. 


BY MR. 


Q Okay. | just have two final questions. 

What were the major lessons learned? You maybe explained one of them, but | 
want to give you full terrain here to talk about lessons that you took away from January 
6th, obviously from your corner of the world in the intelligence branch at the FBI. 


A | will say that | want to make sure that everybody understands that we took 
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it very seriously. Like, we were there working 24/7 prior to the event. Butasa 
takeaway, we want to do better. Nobody ever wants to see what happened on January 
6th happen again. Soas we reflect on this, that's where we've changed the way we 
share information with our partners. 

We would lean more into source development as well in making sure that we 
have -- | mean, it's something we always strive for, but we'll continue to strive even more 
direct into. 

And out of this event, you know, we'll continue to prioritize domestic terrorism 
investigations to develop, again, that more robust source database. 

Q What sort of recommendations, if you know -- what would you think 
that -- if you -- you wished you could have had at your disposal or what would have been 
different that would have empowered you or your branch to get, you know, to be 100 
percent, as you've said, right, to not have any gaps, to not have any failures, if there were 
any? Just what -- in an ideal world, what would you recommend? 

A Lawful access and have lawful authority. 

Q Explain that. 

A A lot of encrypted apps | can't get into, even when | have the lawful 
authority to look inside of them, | don't have that ability. And that is what we often talk 
about would go inthe dark. That singularly would be exceptionally beneficial to us. 

Q Okay. Is that a technological that the encryption -- how do you solve that? 

A That platforms that offer these encrypted services should have an 
unencryption key. 

Q Okay. And they would have to be regulated in order to -- 

A I'm not saying that we have to regulate them. __|'m just -- you asked me 


what would have made a difference for me in that we always struggle with that piece, 
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that lawful access. When we talk about | serve lawful paperwork, | go through all the 
peeling of the onion when | can serve actual lawful and | get nothing back in return. 

Q Okay. Any other either paradigm shifts or shifts in thinking or resources 
that you think in your former position would have been helpful? 

A | will never -- no, not in that moment, | did not need more. | did not 
believe, | did not need more resources. Again, I'm always happy to take more resources 
if somebody wants to give themtous. But in that moment, | think lawful access would 
have helped us. Not necessarily seen the difference, but as we talked about, | don't 
have access into a closed forum. Wedo that for First Amendment. You know, we 
want to protect people's rights. We live in the United States fora reason. So anything 
like that, though, | would have to push back over to our legal or our law units. 

Ms. Greer. We're more than happy to engage on lawful access along with the 
Department if that's something the committee would like to discuss further. 

[Discussion off the record.] 

BY MS. as 

Q I'm just wondering in terms of approaching kind of the intel landscape. 

And | understand that you've mentioned that the First Amendment protections exist. So 
| guess the challenge for us is always when talking to law enforcement is that tension, 
right, between the protected speech versus something that becomes specific or 
actionable, and how do you solve for that when something like January 6th happens. 

And, in hindsight, you could look back at all these different warning signs that were there. 

Do you -- how do you reconcile that based upon what -- the job that you had? 

A | will say that we were seeing what was open publicly available, we were 
seeing that. It wasn't that we didn't have that. But we didn't have people coming in 


and telling us, hey, your target subjects are talking on encrypted channels that you don't 
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have access to. You should get a court order to get into those access. Like, we didn't 
have that kind of coverage, so we didn't have that knowledge. So hindsight's 20/20 on 
that. 

Q Sure. | get kind of the -- 

A But that First Amendment thing, like, that's a very tenuous tightrope that we 
walk all the time. That's why | talk about, like, we have legal all the time making sure 
that we are staying in the right lane, that we aren't impeding on that. 

But as you talk about, like, looking back at everything we missed, we were drawing 
all of that stuff out of social media. We had all the stuff that was available through open 
source. We were getting that. And we were obviously concerned, which is why we 
went to the extreme of pouring more resources on to the social media, to ensure that we 
were tagging stuff, you know, cert unrest, to making sure that we were talking to our 
partners regularly and sharing information, to standing up a command post that was 
24/7, to doing 2-hour briefs, and to put in all of our response assets on standby, active 
standby. 

Like, | didn't have a crystal ball. And so we were really trying to work within 
what we were seeing. And we were seeing the same thing. _ It's really easy when, after 
an event, to look back and go, oh, that's really inflammatory, but it's just inflammatory. 

It still isn't a statement, even put together with 15 other people that say, we're going to 
go getcrazyinD.C. It's still 15 people telling you, I'm going to get crazy in D.C. What 
are they going todo? They're going to get crazy in D.C. | don't know what that means. 

Q But at any point does that volume of people saying the same thing or coming 
to D.C. or coming after our lawmakers, this election was stolen, all of that kind of 
drumbeat of the same messaging from a vast amount of people as you saw on social 


media, when does that shift the narrative from this isn't just protected speech, it could be 
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something more? Was there ever any such discussion? 

A Obviously, we were having that talk. We were having that discussion. 
That's why we had -- we had the ability to open the Type 3, is we were not just looking at 
protected speech; we were looking for signs of violence against that protected activity 
that was going to occur in that Ellipse area, which was, you know, a protected gathering. 

And, yeah, there were -- there was a lot -- that's what we were saying. We were 
looking at all of these things. We're seeing hotels get full, we're seeing buses book up, 
we know people are getting permits. We know that alot of people are coming. And 
they're saying, we're coming to "stop the steal." But what does that mean? We're 
coming to MAGA, Make America Great Again, but what does that mean? And that's not 
very specific. 

Yes. And that's why I'm saying, everybody was on a heightened alert. | 
don't -- | talk about | have 100 command posts, but | don't stand up my HRT on ready 
callout to come respond to D.C. in the blink of an eye. That's exceptional, that's huge. 

| brought in two SWAT teams from Baltimore and put them in the national capital 
region for rapid response. That's exceptional. | put all of my teams on stand-by and 
had everybody, ina COVID environment remind you, when nobody else is at work, we 
have got people shoulder to shoulder sitting in our basement ready to deploy in an 
instant, because we know it's uncomfortable in the city. We are uncomfortable with 
what we've seen. But we don't have specific things that we coulddo. If we had, we 
would have. We absolutely would have. Nobody, nobody wanted this outcome. And 
nobody wanted anything violent to happen that day or at any other event that had 


previously occurred. 
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[2:48 p.m.] 

Q And understand the Bureau took a number of different steps. | guess, as 
we, you know -- looking at the entire landscape in hindsight, there is this public narrative 
of what more could they have seen. __If a layperson who's not a law person is seeing all 
these things on social media and everyone said -- calls it there were warnings in plain 
sight, that law enforcement could've done more, what's your -- what's your reaction to 
that? Because, as you say, you're seeing the same things on social media. 

A | don't have -- as a Federal Government agency, | don't have authority to do 
more than what | did, and that's what we went through. We went through our process 
with the legal authorities that we have on that moment leading up to January 6th. So 
everybody says, it was in plain sight; | don't understand that. Plain sight what? Again, 
I'm coming to Stop the Steal. What doesthat mean? They were going to commit 
violence. If everybody knew and all the public knew that they were going to storm 
Congress, | don't know why one person didn't tell us, why we didn't have one source 


come forward and tell me that. 


Q Well -- 
A | wish | did. 
Q_ --certainly there were -- it wasn't just we're coming to D.C., we're going to 


Stop the Steal. It's we're going to be armed. There were maps of routes that people 
were going to take. There were many items that were flagged in the _—— 
packages that were provided to you that were -- that was more than just we're going to 
come to D.C. and Stop the Steal. So those were the data points that people say these 
are warnings in plain sight. 


A And we took those warnings in plain sight, we stuck with command post. 
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We worked 24/7 trying to gather information. We canvassed all of oursources. We 
looked into all of our cases. We put -- we worked inside -- we had people inside of 
Metro. Metro had acommand post out. We had people inside of Metro. Wehad 
Metro inside of our command post. We had partners inside of our agency working 24/7 
as well. We're sharing information as soon as we get it. We're doing everything that 
we legally can. 

Q So just to -- and we're wrapping up this point and the entirety of your -- 

A And let me just finish this one point, too. 

Q Sure. 

A The [in stuff was shared with our partners, so they had it as well. 
So we weren't sitting on something that was the key to the kingdom and we didn't share. 

Q__ | think, whenever the response is we shared it, it's more so what internally 
could you have done, what processes could have been different that would've impacted 
whether there was a product issue or intelligence issue? So that's separate from sharing 
it, right? 

All of this information you've established was shared either through briefings or, 
you know, in the system itself. But how could that -- that -- all that information have 
been put into a different way in terms of a product, | think is, that's the big picture we're 
asking. 

A Again, | think we've already covered that -- 

Q Sure. 

A -- in the sense that we've said, like as a takeaway from this, if that's what the 
committee feels would've made the difference, we absolutely can produce a product in 
the future in regards to this. | will say, again, that we did produce twelve products that 


year specifically related to domestic violent extremists. 
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Q But none of those twelve products were specific to the event of January 6th? 

A Correct, but they all billed to the event of -- that this is what we were looking 
for -- 

Q But it's hard to say there's twelve products about domestic violence 
extremism when there's social media posts about January 6th specifically. So there's no 
intelligence product about January 6th? 

A So | could've written a product -- again, | don't want to get, like -- 

Ms. Antell. | don't know that it's worth -- 

Ms. Moore. Going back and forth. Like -- 

Ms. Antell. You have a -- 

Ms. Moore. --| can write a product -- yeah, | think you want me to give a 
different answer than the one I'm going to give. 

Q No, and -- 

A And so | can write a product that says, We are seeing thousands of posts that 
say Stop the Steal. We are seeing posts of individuals saying, Hey, bring your guns to 
D.C. Weare seeing posts -- or we have been provided on closed forums that we have no 
means to vet or direct investigative activity, someone provided me a clip of this. 

| can write a product, but that's a useless product. That doesn't meet the four 
corners of an intel product. That just tells you in general, Hey, this is what's out there. 
It's not making me -- my analysis off of that would be something -- if -- we have a 
potential for violence in the Washington, D.C. area of responsibility on January 6th, which 
is what had been shared to all of our partners, which is why we were in the red States. 

Q Okay. So just -- this is the final. So the potential for violence in D.C. -- the 


potential for violence in the D.C. area was shared with your partners? 
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A Yeah. 
Q Okay. But -- and that is the stand-alone of what was shared? 
Okay. 

Q But! guess here's where I'm confused. Is what you're seeing on the social 
media posts, that's all shared during these briefings as well, correct? 

A Yeah. And they're seeing them too. They have -- they have really good 
tools as well. They're not limited like | am. 

Q- Okay. Soit basically -- and I'm thinking out loud here. You're -- you find it 
credible enough to share with law enforcement partners, but it didn't reach the level to 
issue any kind of bulletin. Is that fair to say? 

A | think we made a decision that clearly the committee disagrees with. 

Q  No,no,no. Please, I'm not -- when | ask the question, it's not an 
assessment of the committee. It is a question | pose to many folks who have sat here 
about whether that joint intelligence bulletin would've made a difference. Some have 
said yes. Some have said no. So -- but the -- it's a question. It's not a conclusion. 

A From where | sat on that day, a joint intelligence bulletin with the 
intelligence that | had and that the partners had shared with me would not have made a 
difference. It wouldn't have changed how we postured ourselves. | mean, we were 
extremely well-fortified and prepared to help in any way possible, as were many of our 
partners. 

So regardless of that piece of paper that said we got a lot of social media, there's a 
lot of people coming to D.C., looks like they might want to do some violence and some of 
them are going to have guns, | would have still been monitoring my Type 1s and 2s. | 
would've had a Type 3.__| would've been canvassing my CHSes. | would've been 


monitoring my subjects. | would've been standing up a 24/7 command post, and | 
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would have had my assets exactly posed exactly as they were. So, | mean -- 

Q | appreciate that. 

A -- that's where we were. 

Q_ _I|don't have anything else. 

Q Yeah. Is there anything we didn't ask you that you wanted to share with 
the committee? 

A No, | don't think so. | will say that | hope | haven't like misspoken on 
anything. _ I've tried to be as honest and direct as | absolutely possibly could with the 
exception of talking about closed investigations -- or excuse me, closed -- open 
investigations. The work that the Washington Field Office intelligence team did, they 
were working hard and they were trying really, really hard, and there is nothing | wouldn't 
give to change the outcome of January 6th. 

vs Thank you. We appreciate your time. 

Ve We very much appreciate you taking out 5 hours of your day and 
meeting with us. Thank you so much. 

Mr. Vio | Thank you very much. 
baal Off the record. 


[Whereupon, at 2:57 p.m., the interview was concluded.] 
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